8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe
Size

184KB
MD5

e6ac3f3c94f2da3dd896a828cd021440
SHA1

5931c1c580aac7304ea92132845d07d6e292e7ae
SHA256

8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f
SHA512

6ac87fc02f95b6ad792a4bd38af4e62269caa52e437db620a438aa95d9d059a3088226755e2582e13db2c0891ef163c050fd47bfc422ab45b8d3f9acbaf70437
SSDEEP

3072:frRPwZonv9dM0ZnMQWO5biKQ8jlvnqnxiu4:frooHZnM6if8jlPqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4676	Unicorn-62858.exe
5072	Unicorn-1737.exe
4640	Unicorn-38088.exe
2192	Unicorn-25578.exe
1196	Unicorn-25578.exe
3628	Unicorn-3111.exe
3040	Unicorn-54913.exe
4632	Unicorn-41883.exe
4280	Unicorn-22017.exe
2120	Unicorn-20394.exe
2716	Unicorn-63464.exe
1252	Unicorn-4057.exe
2724	Unicorn-49729.exe
2696	Unicorn-61161.exe
4696	Unicorn-42048.exe
2896	Unicorn-61146.exe
1956	Unicorn-24944.exe
4492	Unicorn-60954.exe
1212	Unicorn-44618.exe
2292	Unicorn-28666.exe
4912	Unicorn-8800.exe
4560	Unicorn-28666.exe
4220	Unicorn-12329.exe
1324	Unicorn-63568.exe
4700	Unicorn-49833.exe
972	Unicorn-44432.exe
3596	Unicorn-47232.exe
528	Unicorn-44929.exe
2772	Unicorn-47912.exe
832	Unicorn-54042.exe
2632	Unicorn-17072.exe
5116	Unicorn-4649.exe
2784	Unicorn-4457.exe
2184	Unicorn-2848.exe
3696	Unicorn-63746.exe
2832	Unicorn-57616.exe
3440	Unicorn-60793.exe
4128	Unicorn-55962.exe
1948	Unicorn-10440.exe
4692	Unicorn-5993.exe
3084	Unicorn-35328.exe
4124	Unicorn-38858.exe
2856	Unicorn-32610.exe
3684	Unicorn-24442.exe
2520	Unicorn-16274.exe
2268	Unicorn-8105.exe
3452	Unicorn-31840.exe
3976	Unicorn-12552.exe
2392	Unicorn-32153.exe
2504	Unicorn-32418.exe
4608	Unicorn-15319.exe
4056	Unicorn-18119.exe
3200	Unicorn-24250.exe
1188	Unicorn-45417.exe
2972	Unicorn-56849.exe
1840	Unicorn-48946.exe
4716	Unicorn-26863.exe
5012	Unicorn-18002.exe
3632	Unicorn-18002.exe
4604	Unicorn-47337.exe
1544	Unicorn-1400.exe
4976	Unicorn-25402.exe
1496	Unicorn-11103.exe
4776	Unicorn-15225.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
7780	5364	WerFault.exe	224
9032	8468	WerFault.exe	359
9072	5908	WerFault.exe	229
19064	16776	WerFault.exe	810
19072	16868	WerFault.exe	812
19096	16612	WerFault.exe	808
19404	1868	WerFault.exe	825
19396	17320	WerFault.exe	819
19380	16508	WerFault.exe	827
18672	17260	WerFault.exe	855
14972	16816	WerFault.exe	849
18708	17376	WerFault.exe	838
18600	4292	WerFault.exe	856
18836	17200	WerFault.exe	853
18796	17520	WerFault.exe	858
19056	18216	WerFault.exe	888
16220	18036	WerFault.exe	877
19008	17588	WerFault.exe	864
19404	18172	WerFault.exe	894
3488	664	Process not Found	1006
17916	18716	WerFault.exe	933
740	18500	Process not Found	1109
5936	17780	Process not Found	1131
17532	18784	Process not Found	1220
5328	5912	Process not Found	1404
1164	8360	Process not Found	1447
6940	9776	Process not Found	1470
18648	5836	Process not Found	1409
7480	7596	Process not Found	1457
5680	5948	Process not Found	1337
12548	5648	Process not Found	1315
18656	10992	Process not Found	1495

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3876	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17568	Process not Found
Token: SeChangeNotifyPrivilege	17568	Process not Found
Token: 33	17568	Process not Found
Token: SeIncBasePriorityPrivilege	17568	Process not Found
Token: SeCreateGlobalPrivilege	17748	Process not Found
Token: SeChangeNotifyPrivilege	17748	Process not Found
Token: 33	17748	Process not Found
Token: SeIncBasePriorityPrivilege	17748	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe
4676	Unicorn-62858.exe
5072	Unicorn-1737.exe
4640	Unicorn-38088.exe
1196	Unicorn-25578.exe
2192	Unicorn-25578.exe
3040	Unicorn-54913.exe
3628	Unicorn-3111.exe
4632	Unicorn-41883.exe
4280	Unicorn-22017.exe
2696	Unicorn-61161.exe
1252	Unicorn-4057.exe
2724	Unicorn-49729.exe
2120	Unicorn-20394.exe
2716	Unicorn-63464.exe
4696	Unicorn-42048.exe
2896	Unicorn-61146.exe
1956	Unicorn-24944.exe
4492	Unicorn-60954.exe
1212	Unicorn-44618.exe
528	Unicorn-44929.exe
3596	Unicorn-47232.exe
4700	Unicorn-49833.exe
4560	Unicorn-28666.exe
972	Unicorn-44432.exe
4220	Unicorn-12329.exe
4912	Unicorn-8800.exe
2292	Unicorn-28666.exe
1324	Unicorn-63568.exe
2772	Unicorn-47912.exe
832	Unicorn-54042.exe
2632	Unicorn-17072.exe
5116	Unicorn-4649.exe
2784	Unicorn-4457.exe
2184	Unicorn-2848.exe
3696	Unicorn-63746.exe
2832	Unicorn-57616.exe
3440	Unicorn-60793.exe
4128	Unicorn-55962.exe
1948	Unicorn-10440.exe
4692	Unicorn-5993.exe
4124	Unicorn-38858.exe
2856	Unicorn-32610.exe
3684	Unicorn-24442.exe
2520	Unicorn-16274.exe
2268	Unicorn-8105.exe
4056	Unicorn-18119.exe
3452	Unicorn-31840.exe
3976	Unicorn-12552.exe
2392	Unicorn-32153.exe
2504	Unicorn-32418.exe
4716	Unicorn-26863.exe
4608	Unicorn-15319.exe
3200	Unicorn-24250.exe
2972	Unicorn-56849.exe
1188	Unicorn-45417.exe
1840	Unicorn-48946.exe
5012	Unicorn-18002.exe
1544	Unicorn-1400.exe
4604	Unicorn-47337.exe
3632	Unicorn-18002.exe
4976	Unicorn-25402.exe
1496	Unicorn-11103.exe
4776	Unicorn-15225.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4676	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	90
PID 640 wrote to memory of 4676	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	90
PID 640 wrote to memory of 4676	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	90
PID 4676 wrote to memory of 5072	4676	Unicorn-62858.exe	92
PID 4676 wrote to memory of 5072	4676	Unicorn-62858.exe	92
PID 4676 wrote to memory of 5072	4676	Unicorn-62858.exe	92
PID 640 wrote to memory of 4640	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	93
PID 640 wrote to memory of 4640	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	93
PID 640 wrote to memory of 4640	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	93
PID 4640 wrote to memory of 1196	4640	Unicorn-38088.exe	96
PID 5072 wrote to memory of 2192	5072	Unicorn-1737.exe	97
PID 4640 wrote to memory of 1196	4640	Unicorn-38088.exe	96
PID 4640 wrote to memory of 1196	4640	Unicorn-38088.exe	96
PID 5072 wrote to memory of 2192	5072	Unicorn-1737.exe	97
PID 5072 wrote to memory of 2192	5072	Unicorn-1737.exe	97
PID 640 wrote to memory of 3628	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	98
PID 640 wrote to memory of 3628	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	98
PID 640 wrote to memory of 3628	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	98
PID 4676 wrote to memory of 3040	4676	Unicorn-62858.exe	99
PID 4676 wrote to memory of 3040	4676	Unicorn-62858.exe	99
PID 4676 wrote to memory of 3040	4676	Unicorn-62858.exe	99
PID 1196 wrote to memory of 4632	1196	Unicorn-25578.exe	100
PID 1196 wrote to memory of 4632	1196	Unicorn-25578.exe	100
PID 1196 wrote to memory of 4632	1196	Unicorn-25578.exe	100
PID 4640 wrote to memory of 4280	4640	Unicorn-38088.exe	101
PID 4640 wrote to memory of 4280	4640	Unicorn-38088.exe	101
PID 4640 wrote to memory of 4280	4640	Unicorn-38088.exe	101
PID 2192 wrote to memory of 2120	2192	Unicorn-25578.exe	102
PID 2192 wrote to memory of 2120	2192	Unicorn-25578.exe	102
PID 2192 wrote to memory of 2120	2192	Unicorn-25578.exe	102
PID 4676 wrote to memory of 2716	4676	Unicorn-62858.exe	104
PID 4676 wrote to memory of 2716	4676	Unicorn-62858.exe	104
PID 4676 wrote to memory of 2716	4676	Unicorn-62858.exe	104
PID 3040 wrote to memory of 1252	3040	Unicorn-54913.exe	103
PID 3040 wrote to memory of 1252	3040	Unicorn-54913.exe	103
PID 3040 wrote to memory of 1252	3040	Unicorn-54913.exe	103
PID 5072 wrote to memory of 2724	5072	Unicorn-1737.exe	105
PID 5072 wrote to memory of 2724	5072	Unicorn-1737.exe	105
PID 5072 wrote to memory of 2724	5072	Unicorn-1737.exe	105
PID 640 wrote to memory of 2696	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	106
PID 640 wrote to memory of 2696	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	106
PID 640 wrote to memory of 2696	640	8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe	106
PID 3628 wrote to memory of 4696	3628	Unicorn-3111.exe	107
PID 3628 wrote to memory of 4696	3628	Unicorn-3111.exe	107
PID 3628 wrote to memory of 4696	3628	Unicorn-3111.exe	107
PID 4632 wrote to memory of 2896	4632	Unicorn-41883.exe	108
PID 4632 wrote to memory of 2896	4632	Unicorn-41883.exe	108
PID 4632 wrote to memory of 2896	4632	Unicorn-41883.exe	108
PID 1196 wrote to memory of 1956	1196	Unicorn-25578.exe	109
PID 1196 wrote to memory of 1956	1196	Unicorn-25578.exe	109
PID 1196 wrote to memory of 1956	1196	Unicorn-25578.exe	109
PID 2120 wrote to memory of 4492	2120	Unicorn-20394.exe	110
PID 2120 wrote to memory of 4492	2120	Unicorn-20394.exe	110
PID 2120 wrote to memory of 4492	2120	Unicorn-20394.exe	110
PID 1252 wrote to memory of 1212	1252	Unicorn-4057.exe	111
PID 1252 wrote to memory of 1212	1252	Unicorn-4057.exe	111
PID 1252 wrote to memory of 1212	1252	Unicorn-4057.exe	111
PID 2696 wrote to memory of 4560	2696	Unicorn-61161.exe	114
PID 2696 wrote to memory of 4560	2696	Unicorn-61161.exe	114
PID 2696 wrote to memory of 4560	2696	Unicorn-61161.exe	114
PID 4280 wrote to memory of 2292	4280	Unicorn-22017.exe	113
PID 4280 wrote to memory of 2292	4280	Unicorn-22017.exe	113
PID 4280 wrote to memory of 2292	4280	Unicorn-22017.exe	113
PID 2192 wrote to memory of 4912	2192	Unicorn-25578.exe	112

C:\Users\Admin\AppData\Local\Temp\8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8a2152631b6e163438b0bc33939c919a07bb513d56174943a9d4f3038d74248f_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55962.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        8⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        10⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        11⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        11⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        11⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        10⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        10⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        9⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        9⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        9⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31976.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        9⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        9⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        9⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        8⤵
        
        PID:17548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
        8⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 632
        9⤵
        Program crash
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        8⤵
        
        PID:17992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        8⤵
        
        PID:17260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17260 -s 436
        9⤵
        Program crash
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49820.exe
        8⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24964.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30066.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27653.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        7⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        9⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4388.exe
        10⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40763.exe
        10⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        9⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15083.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2410.exe
        8⤵
        
        PID:16612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 460
        9⤵
        Program crash
        
        PID:19096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35435.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42581.exe
        9⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        9⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20219.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        7⤵
        
        PID:19052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16687.exe
        6⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2994.exe
        8⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        8⤵
        
        PID:19272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        7⤵
        
        PID:18600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        7⤵
        
        PID:16816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16816 -s 444
        8⤵
        Program crash
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
        7⤵
        
        PID:19076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        6⤵
        
        PID:18512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        6⤵
        
        PID:18996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24565.exe
        8⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        8⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        8⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61667.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15762.exe
        7⤵
        
        PID:17852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14576.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        7⤵
        
        PID:18200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34315.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43451.exe
        7⤵
        
        PID:17604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38251.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        7⤵
        
        PID:18632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        6⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        6⤵
        
        PID:19336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        7⤵
        
        PID:18536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59531.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43587.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25402.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60482.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        9⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        9⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26027.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        8⤵
        
        PID:18768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16987.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10532.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        8⤵
        
        PID:18884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12866.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        7⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        7⤵
        
        PID:18520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        6⤵
        
        PID:18452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2537.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        7⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        7⤵
        
        PID:18972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52388.exe
        7⤵
        
        PID:18708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21610.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26058.exe
        6⤵
        
        PID:18960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17368.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        6⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1579.exe
        6⤵
        
        PID:18512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        5⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51077.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        7⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        6⤵
        
        PID:18784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
        6⤵
        
        PID:18104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40636.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        5⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        5⤵
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58562.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4476.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        7⤵
        
        PID:18692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        6⤵
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        6⤵
        
        PID:19256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14195.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15052.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34131.exe
        6⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        6⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        5⤵
        
        PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41848.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        5⤵
        
        PID:18036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18036 -s 464
        6⤵
        Program crash
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        5⤵
        
        PID:18864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        5⤵
        
        PID:18500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
        5⤵
        
        PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
      4⤵
      PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
      4⤵
      PID:18840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
      4⤵
      PID:18116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
      4⤵
      PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63746.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30986.exe
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49346.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        9⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        9⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        9⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        9⤵
        
        PID:19408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55171.exe
        8⤵
        
        PID:18160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5360.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        8⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        6⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9556.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        8⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        7⤵
        
        PID:18812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30236.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        7⤵
        
        PID:19224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63643.exe
        7⤵
        
        PID:18832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59261.exe
        6⤵
        
        PID:19296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        6⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        8⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        7⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7664.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37580.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        6⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43643.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24663.exe
        5⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        7⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28227.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        6⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        6⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        6⤵
        
        PID:18792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32442.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        5⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        5⤵
        
        PID:17588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17588 -s 464
        6⤵
        Program crash
        
        PID:19008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51051.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        8⤵
        
        PID:17200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17200 -s 424
        9⤵
        Program crash
        
        PID:18836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        8⤵
        
        PID:19044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64268.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        7⤵
        
        PID:17520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17520 -s 464
        8⤵
        Program crash
        
        PID:18796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38259.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45091.exe
        7⤵
        
        PID:19024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        6⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53186.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        7⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55275.exe
        7⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64579.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        6⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        6⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        5⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        5⤵
        
        PID:18840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        7⤵
        
        PID:18464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        6⤵
        
        PID:18964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54283.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50947.exe
        5⤵
        
        PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50513.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        5⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42619.exe
      4⤵
      PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        5⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
      4⤵
      PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41941.exe
      4⤵
      PID:14720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
      4⤵
      PID:18564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
      4⤵
      PID:19260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
      4⤵
      PID:18236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14680.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        7⤵
        
        PID:18084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53499.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46132.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        6⤵
        
        PID:17576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        6⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        6⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35052.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53611.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
        5⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        7⤵
        
        PID:18124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63555.exe
        7⤵
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60931.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48212.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65405.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        5⤵
        
        PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28311.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58492.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34165.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        5⤵
        
        PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
      4⤵
      PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12660.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        5⤵
        
        PID:17912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
      4⤵
      PID:11076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25451.exe
      4⤵
      PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9361.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63540.exe
        7⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        7⤵
        
        PID:17900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        7⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        6⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42909.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53411.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33869.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3516.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49956.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        5⤵
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40515.exe
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
      4⤵
      PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
      4⤵
      PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6034.exe
      4⤵
      PID:18656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15319.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        6⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        5⤵
        
        PID:18556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
      4⤵
      PID:14928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
    3⤵
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
      4⤵
      PID:18528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
      4⤵
      PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2116.exe
    3⤵
    PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      4⤵
      PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      4⤵
      PID:716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
      4⤵
      PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
    3⤵
    PID:6176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
    3⤵
    PID:14452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
    3⤵
    PID:18596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        9⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        10⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        10⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        10⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        9⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
        9⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        9⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58212.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21715.exe
        8⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
        8⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        9⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        9⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        9⤵
        
        PID:18752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        9⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        8⤵
        
        PID:18820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6410.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
        7⤵
        
        PID:19124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        6⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18877.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        9⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        9⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        9⤵
        
        PID:18608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
        8⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        8⤵
        
        PID:18956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55435.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17411.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36200.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52948.exe
        6⤵
        
        PID:16508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16508 -s 452
        7⤵
        Program crash
        
        PID:19380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9770.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56450.exe
        6⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10352.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46235.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26677.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        8⤵
        
        PID:18472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        8⤵
        
        PID:19288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        7⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        6⤵
        
        PID:19312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
        5⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51700.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        6⤵
        
        PID:17376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17376 -s 456
        7⤵
        Program crash
        
        PID:18708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
        6⤵
        
        PID:19412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8851.exe
        7⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        7⤵
        
        PID:18900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        6⤵
        
        PID:18860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        5⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5058.exe
        5⤵
        
        PID:19024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46315.exe
        5⤵
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39922.exe
        6⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3113.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53915.exe
        7⤵
        
        PID:16776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16776 -s 464
        8⤵
        Program crash
        
        PID:19064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8338.exe
        7⤵
        
        PID:18584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5552.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8370.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44523.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25172.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        6⤵
        
        PID:17320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17320 -s 464
        7⤵
        Program crash
        
        PID:19396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55997.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3336.exe
        5⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        7⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8468 -s 472
        8⤵
        Program crash
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30635.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6363.exe
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2386.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        5⤵
        
        PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55490.exe
        5⤵
        
        PID:720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-529.exe
        6⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 632
        7⤵
        Program crash
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65228.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64179.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:19228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16538.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48716.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        5⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38509.exe
        5⤵
        
        PID:19360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63201.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59484.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        6⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18538.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39996.exe
        5⤵
        
        PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7547.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34066.exe
      4⤵
      PID:4292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 464
        5⤵
        Program crash
        
        PID:18600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
      4⤵
      PID:10048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        8⤵
        
        PID:16868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16868 -s 464
        9⤵
        Program crash
        
        PID:19072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13002.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45747.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11642.exe
        7⤵
        
        PID:18464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61300.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8746.exe
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        6⤵
        
        PID:19284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37160.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        6⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47445.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        7⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39436.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        6⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46672.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        6⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-179.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        5⤵
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22848.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61788.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6746.exe
        6⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 472
        7⤵
        Program crash
        
        PID:19404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        6⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        5⤵
        
        PID:18480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44648.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        6⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9363.exe
        6⤵
        
        PID:19008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15643.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1538.exe
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49316.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
      4⤵
      PID:14412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
      4⤵
      PID:15780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        7⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        7⤵
        
        PID:18520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37371.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        6⤵
        
        PID:18216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18216 -s 444
        7⤵
        Program crash
        
        PID:19056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        6⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11850.exe
        6⤵
        
        PID:18924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        5⤵
        
        PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45329.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45018.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        6⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19442.exe
        6⤵
        
        PID:18776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34965.exe
        5⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12242.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
      4⤵
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      4⤵
      PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
      4⤵
      PID:15524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        5⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        5⤵
        
        PID:18448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39275.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
      4⤵
      PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54787.exe
      4⤵
      PID:18148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58184.exe
    3⤵
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        5⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        5⤵
        
        PID:19448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
      4⤵
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
      4⤵
      PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
      4⤵
      PID:18584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
    3⤵
    PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22005.exe
      4⤵
      PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11475.exe
      4⤵
      PID:18172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10596.exe
    3⤵
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
    3⤵
    PID:16300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42892.exe
    3⤵
    PID:4344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50083.exe
        8⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        7⤵
        
        PID:18076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62363.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        6⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        5⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        6⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9363.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29011.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42195.exe
        5⤵
        
        PID:19240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50205.exe
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2523.exe
        7⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        6⤵
        
        PID:18804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        5⤵
        
        PID:18948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30423.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        5⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5732.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
        6⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19450.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        5⤵
        
        PID:18572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      4⤵
      PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
      4⤵
      PID:18232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        7⤵
        
        PID:19048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60621.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50044.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44093.exe
        5⤵
        
        PID:18828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
      4⤵
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        6⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20090.exe
        5⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34236.exe
        5⤵
        
        PID:18796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        5⤵
        
        PID:18628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
      4⤵
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        5⤵
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      4⤵
      PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
      4⤵
      PID:100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1400.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3881.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        6⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41979.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        5⤵
        
        PID:19348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
      4⤵
      PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27018.exe
      4⤵
      PID:19092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      4⤵
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21474.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        5⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        5⤵
        
        PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      4⤵
      PID:16504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      4⤵
      PID:17488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60484.exe
    3⤵
    PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5860.exe
      4⤵
      PID:17076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43077.exe
    3⤵
    PID:11096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6186.exe
    3⤵
    PID:15592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57794.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34130.exe
        7⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        7⤵
        
        PID:17780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6931.exe
        6⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        6⤵
        
        PID:19372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17091.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
        5⤵
        
        PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62625.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16027.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        6⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
        5⤵
        
        PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14383.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23723.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44211.exe
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
        5⤵
        
        PID:18716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18716 -s 456
        6⤵
        Program crash
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
      4⤵
      PID:13816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
      4⤵
      PID:18172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18172 -s 452
        5⤵
        Program crash
        
        PID:19404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
      4⤵
      PID:1060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
    3⤵
    - Executes dropped EXE
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25047.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26954.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        5⤵
        
        PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32866.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
      4⤵
      PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      4⤵
      PID:17196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
    3⤵
    PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
      4⤵
      PID:16280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
    3⤵
    PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11724.exe
      4⤵
      PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    3⤵
    PID:11476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
    3⤵
    PID:15684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
    3⤵
    PID:17068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54945.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        6⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        6⤵
        
        PID:18760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9130.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        5⤵
        
        PID:18180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30914.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        5⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        5⤵
        
        PID:19328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27810.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
      4⤵
      PID:16336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
      4⤵
      PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        5⤵
        
        PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21035.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33826.exe
      4⤵
      PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5891.exe
      4⤵
      PID:18068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5639.exe
    3⤵
    PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33693.exe
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      4⤵
      PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
      4⤵
      PID:18028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-371.exe
    3⤵
    PID:9860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42283.exe
    3⤵
    PID:18016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
      4⤵
      PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29115.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        5⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45348.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54900.exe
      4⤵
      PID:18004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27189.exe
      4⤵
      PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56068.exe
      4⤵
      PID:17464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61876.exe
    3⤵
    PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50547.exe
    3⤵
    PID:15096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
  2⤵
  PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13305.exe
    3⤵
    PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
      4⤵
      PID:15172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
    3⤵
    PID:8908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
    3⤵
    PID:14504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
    3⤵
    PID:16564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5666.exe
  2⤵
  PID:7240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59827.exe
  2⤵
  PID:11152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60692.exe
  2⤵
  PID:15164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5364 -ip 5364
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8468 -ip 8468
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5908 -ip 5908
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 16220 -ip 16220
1⤵
PID:18724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 16868 -ip 16868
1⤵
PID:18900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 17296 -ip 17296
1⤵
PID:19412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 17272 -ip 17272
1⤵
PID:19424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 17096 -ip 17096
1⤵
PID:19436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 16452 -ip 16452
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 17260 -ip 17260
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1308 -ip 1308
1⤵
PID:18484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4292 -ip 4292
1⤵
PID:18872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1308 -ip 1308
1⤵
PID:18492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 17860 -ip 17860
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 17532 -ip 17532
1⤵
PID:18684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 17588 -ip 17588
1⤵
PID:18764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 17520 -ip 17520
1⤵
PID:18780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 18232 -ip 18232
1⤵
PID:18868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 18052 -ip 18052
1⤵
PID:18016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 18224 -ip 18224
1⤵
PID:19004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 17844 -ip 17844
1⤵
PID:18988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 18060 -ip 18060
1⤵
PID:18840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 18208 -ip 18208
1⤵
PID:19156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 18124 -ip 18124
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 17992 -ip 17992
1⤵
PID:18452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3956 -ip 3956
1⤵
PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4064 -ip 4064
1⤵
PID:17884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 18752 -ip 18752
1⤵
PID:18560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 18784 -ip 18784
1⤵
PID:18468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 664 -ip 664
1⤵
PID:18800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12329.exe

Filesize
184KB

MD5
83daee31494b086c2f2d82995a74d493

SHA1
6bd57dc7911ba0e6b5eb9a1e5975eed917cd9242

SHA256
d9dcedcd8ac967f166ee83c29bc85d5f6d4e3d45c8ea968af3cba1b3404b7970

SHA512
0b9f78a124176bb7699cb31b9df2043cf407a8e07d8b08889dfd7755ea49c2e5cba78f1ee8f1a886c9c44803104e82a7a8e7bbbaf444885d51edd66588d8e213

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17072.exe

Filesize
184KB

MD5
8dbce54fb2d7a089900e0bcd79b06b76

SHA1
c3bd3c8f4becc67bcb5ea4f33d83483ceb004503

SHA256
f381710d2ed19e7cdc52805ba6a508b6fb6fffad0be7d65181f354ffd341fab9

SHA512
d8877ef67a1fe334e6aeeb7a70e42a9ac16e7fe4dc7e036b4c9632543813a7d50d08473d3656000b80078eaf993e3e20c3f60e370fb5abf844c379ee24239fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe

Filesize
184KB

MD5
f21101dd7f0d3a6ea7732b6399b4761c

SHA1
dd36bfdb2c76cfa0dd955059a6f1c65f31c77bdb

SHA256
975e5621da14c7b02380a2e0eabfdff8f1e4a1e17e22fea66af869462fae844d

SHA512
14a760e93db87140fb2941068ccb623836c4e12d5f4a2693323f90d9d87230c39b4a15726d5f980baf60e344b33739e112953514aa2375df6ce1b92f3b96a806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe

Filesize
184KB

MD5
b2d5b0c26e2d6f86af51dbc0526e2b18

SHA1
b12536ec33be2c2b6f4a44d0cbcd4da02084e43b

SHA256
2804f2e520c6842cd11cbe3027c38a7730e68fc818adf52770ec05803c7f635c

SHA512
6db596286e4b42e565c1df8ef6786ff4fb0b0391af2be2b820e42001b940955224c6cb0f4932c774a093627ff3cd92d1df80e685849bf36e197469c59270affd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe

Filesize
184KB

MD5
095221633e7d988c53f6d5ee08971a15

SHA1
add9211f175699932b4a5ca080db6748e3873482

SHA256
0ca55654cb8e54abcf23b001aabafc7f3814972b98e7b58dc7093739e5dd8169

SHA512
875338ad3f8e0ddd1bb4bf41e6f7fbc755a019b433b1e90bdfa75fe29f7b9088b0c638e646c029d1eb0009e4b8ebd6220a3e95f0aaa2c1185e91560c538bcdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe

Filesize
184KB

MD5
7422efacc4aef7c611227ed465c1e0f1

SHA1
d69c841ff66a6b23c13c8d57ec26cbd46b06cd32

SHA256
4141cfb4516687fddcb78a2e4be79ce72798bb356e40ff626e8fa9986ea408de

SHA512
8b2fdc142e475ba7574777e439b45020111da5dd881bbe87a1c39ae56cf2daa08521275edba7863f6e96081166e9c413e5ce5ca3a8ce86cf6749af1057072514

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe

Filesize
184KB

MD5
43e40daf623530f78cdeca41a0e6a72e

SHA1
30ae7c782f329c745cf9de7ecb44b80ddae52aec

SHA256
414fd1e772b2ed65d96627af5ccaa085cc52d6e11f961aebc1c969eb0f71b2f8

SHA512
49686c57a6d12d68ffa89c9eb0fb0ccf9756bc590fa06dfddba6f7f544e7f5d9ee391467c256b408cb8225ab83682edf15b2c02c7cc045bad81f29e5d8241701

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe

Filesize
184KB

MD5
81622c9ae58abbcfe82674f635438161

SHA1
f01b859b8defaa93ec198a07cffc6015aca02f0e

SHA256
55d1f8458cf53054ff17709d6aecebeb985ca41d80847857c0f41f8bba0e681b

SHA512
0cdcec70bd6882faa518d60445202062b528437e3f9cdc2d53101c5c488f1fa061826a5ebf4ec129b3a096aaa94c40ca54206a35691d9ecf718b6dc4429b1858

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe

Filesize
184KB

MD5
d26b629ebfa0b988ab9cb79bd0cf41c6

SHA1
d5ca842bcfc0c6e623777eb6efeeaf88bc435010

SHA256
f1cd1f1fd485d19689275365cc66979f82486bfe985787dbeb30fb622112b6e6

SHA512
8ad52d292566456ee520543bb000045ffd77ee8fa7335fc39b90fcf421c03261b5d97b9e6fbf8c9fffce9384a9210487312eaf424d9d299485aa71b43df4f9c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe

Filesize
184KB

MD5
3ed217abf762e78f3c638401e8a2b08c

SHA1
0c76ea445d6e8e7905211137d8a04f0600909b5c

SHA256
6e9b2547582ebdd8a6f5ad08079669ad7b90372954d8d0bbc3b2820c6999a3f8

SHA512
c7af8aef35df34ad52d1fb4921ca6f12128d58f408ebd84778d84ba67fecfd46ed58baaedfc353965c4442fbefd0e208aa81ad8c640f9adae374ce2b0596c462

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe

Filesize
184KB

MD5
1bf5d3c3f8a31b78a5ea76dffd2a8eb2

SHA1
0b29c0baf6ea7f4c7b207962880f71e809067fdb

SHA256
fc6993eb30c50ea7693d2e210f2531eaf59718f35cca8ed8e147b041dacf4727

SHA512
fb4924f66d37045ffb68546c3c3438b29acb84e39b90d8a1b390252734d8a53eeddefaed12bf94cbe954c277e86391113bf4fd37175cf84389cbce905b40d046

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41883.exe

Filesize
184KB

MD5
3a190c44fe7b083c1352c0d9133b681b

SHA1
4ff37870a150a9a8d9a0fbc0ef3a2b39aeebf8f1

SHA256
f65e21e2bd9ff2fc333e3242aec70e9039c6744c860fd81c243fdd0341a0c598

SHA512
e733c1f413d84f14687614d18a5cae72ebc616e24fd2d565f1c3e009fc63e296c3311b1f251c530344e9b29a91d1ab117a53773dcff47aa15870d4af6ed07ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe

Filesize
184KB

MD5
b2eba2eeaf30e017ec74e7a1246d9c0e

SHA1
666cdb9fcd1735f19f2df0ec2be79cf7341bfb94

SHA256
8a1e358b1f25545fcd58efedf7a4cde913a6b66940e1b99b4fda202efc45c10e

SHA512
5f4a8c7011721fd93d93146c38efe5547ae8a937bc1b966ee01edfe1ecac4c2e772fef20af1ce845d7484e730a8191912c6877f3b282a307fb4d2a98b133a6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44432.exe

Filesize
184KB

MD5
7c9ede00f4342b034a8fe1487c4b5362

SHA1
edb4fc3fa79f45df92e2a0fd4e97baf55c2abc38

SHA256
fe9219016e431b3d41364e2acce0ba61698f9a602b3cb1a0fe4f1e07efc69208

SHA512
345104dd0b6d256ff3dc59eaad39b7ab74899a40f98d9d94111bba75256dfdfcc5762a3bf53720f33ade7b06afbfeb0143c2990dbd888aefac22f4ef36a75b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe

Filesize
184KB

MD5
b717f207b2e2a96b9758b4fa3eaa83ae

SHA1
d4b85cffeea22123902a43ab2f2cdd1dba3312cc

SHA256
44ee3103645c2b69a373c386b67149dfbccaaa7de1873f36383547ab91319cb1

SHA512
f74bf848b06b38daede459da33464d7bf261eb330547bdb056347543fb65027c469a1b98d203ffebd0d5112a37704e77355d9f595f030b076a747dd3041870bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe

Filesize
184KB

MD5
02df65dfeff7d610f35bfe04de8d61bc

SHA1
800716c7e1867c8b9663e445729e1bda72ddd17f

SHA256
813441ad211b552bc5acc41bfd723b2e978408353062cbeb61f18d0e5019b44b

SHA512
69d6b3b31c0897e9e57141d8fe634d1fc455fe0c7b52d6bbaecfc0ae881fee8b5ad2d7311665018b37b853cce0cdef6f0f42a41523aa20486772f1a4606a9206

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe

Filesize
184KB

MD5
8624bd6f0f289fd7d8b7fcbd40180da6

SHA1
dbf90c9b076e22c360a4ea6a330371e325c0f91f

SHA256
78465588a309af4f444bb77a3dca2a869870aca842a4d3d9397892b339b89e4f

SHA512
c6778ad419145b8b0709cecfe0639546c7880388935947c3ab6c10815611bc1dc9166771b6545d4a50ad9d907c8fffe89cdb07ae486b61d256f597c0980e2b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46781.exe

Filesize
184KB

MD5
42fe6d3b928d1f4e982c377b82fe2cf8

SHA1
8f39f11fabc701db49553294d306d6cbb74aa584

SHA256
f5df9fd158ee993b06612f9ed9cf6e8c53fd440cf725aebdf43fd4abd0667c65

SHA512
bc7831c73c8829ee21b0f6c58bfbf5f4bc7c755f1122283574e073f17ecb3ad422b9f80e51990ec6e2620365eea212af9ae0147a8d4e35625662527cd3e51f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe

Filesize
184KB

MD5
9bcc3859f8345b6f1d00039d160c644c

SHA1
7f474c15d37b75c0abb8e66e857acc2a91f5fb4e

SHA256
337af3ee975be4c763f44e8c2d056d558d4b447d8418eeb33d24282e509d0482

SHA512
d8a74d13db593f6fe63a333bc2455fd6e859bc3c29f05ede57fab55bc3d6d87fbcc396ed85f67d3847772dbfad48d7fc08bdfb8c045eb5d40ddb78cf7171617e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe

Filesize
184KB

MD5
6cf533413135586ae4d9b1afec9d890c

SHA1
36a3a116d5e0cbc013ae9cbfe8891b44cdb8523d

SHA256
66897205f645f56441d779d9a964c25331218db700af272e0ae86939117ed422

SHA512
f630563262ebd1390389cbc64c93a956fb8fe82dee4fe560ae61b020188460e0dbaa0cf8a5ebe1046457da82fe511b6739efe1023e69e8877ebfe34dbeca1cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49729.exe

Filesize
184KB

MD5
27aa2193ffd4f54bc0f2273ed2a3e968

SHA1
804f132d541bd4495dd2c5255053e00b36e3d667

SHA256
0124ca176581ba3f0bab09ee1cb2a88c462cb991da1f172d54e4189fa2ed5dde

SHA512
16faad145c6711edc6cc703c32bc4bee5f8938ee17fd4ecdcf60802ce43c2ed45b1d81546ec0cf8feef8039e7ebdbf0d6a6c257e4ef843df827918b29f949d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe

Filesize
184KB

MD5
b82a58929c861f22f9af3cb0b2d37b0b

SHA1
bb13613dbaf86845a125bf5942d214782a678148

SHA256
c73c0d88aca76f520bb3abbbe18270ca52d7178a848c848ef3823595e178735d

SHA512
280b596e1897d0c1693a03c72de4b6ab6eb43ea9b0599c51ccfc6817e2eef3c5ab8f909f758c2b31a4c26916c98404bf58541dee15bf650e2f4431532a57def6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe

Filesize
184KB

MD5
5257a1a0bfdc388d50f1f2306f671d13

SHA1
63b5036da2b1ad1a0beb0c6f278f4457581c43c9

SHA256
69b27477a2ecc97994fa9f938a5af21eaf368443b98e4613797cb52f7c98c1e8

SHA512
92ae19c7a265640ab9650abc79bddb58b6755a4ea2bb800223ae6bfbb7d30331b448d50b71fcc8b8ca4dcea8132dab8f26961f34978ef4a20967c08afb0e81c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54042.exe

Filesize
184KB

MD5
91d8b2dbb50b81d335169d20bcdc2044

SHA1
bf5bf8b387ffee48394c85793c41cea1fcbf6b0b

SHA256
1cdce8276454c760dee73bc550d9f0399359ed32d358a627eb60321742259072

SHA512
da76d2628e2f70b39372b6b43039d9e7573282f734c856fa377520accf2ba1b45c463f57f140d37038254102a93612cc16a9717dfce1a89623001d1133d10939

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54913.exe

Filesize
184KB

MD5
8009a0c87a5e7a0ebfa52eb96c6acd81

SHA1
54211c403faf27d8f85b463784e4dc631b7e2c86

SHA256
5aa8c22cbd37f79367a072d8eefe19305a8f70832db096e9726ead743ba07d7f

SHA512
592fc87d52fca9d37f69aedd53f413b03ffe7e1a81d5d8bea540cfca7e4854c0eda3ffbf9c172a3dd44a421a415b40bdce6a892122c6b223b6facc91529b6348

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60954.exe

Filesize
184KB

MD5
ec9193b2782a00cc92f4d96211d5d3a2

SHA1
8a37c053d121d59d81b87d819c72e6c81f9712b0

SHA256
81d7de52a66ff62418a83866c237e19784360e329c1303edae1b961a8398cd16

SHA512
8707b5c6c16cbd1c2a7208062cfcf2f95a2e7d17d2c98dea6dd57caee44fa6cc3a86db583486d54e5d986afff762be30094e23efc498111ac95a5884fefd1f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61146.exe

Filesize
184KB

MD5
8d9781407aa43ab09082bd65faa217ad

SHA1
a52a7ca0522349dbb4ac3b3465cce4fb78f43001

SHA256
634368a16fd097ac1f13ac4b98863af27cb3d901fb1f52b58d29c77ee8003bde

SHA512
e3965cce815bc3da4c204caadb57a7f8d2769a8d5566ac418becbb912ec29d3396e71fa6ee8c4d98c8d79d5cc8ecb8a0bb629a39edabad8899c9c09a2ea1447b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe

Filesize
184KB

MD5
c45b78d3b8852249b3ddd333a5ba1a5d

SHA1
33c81eb0358ed29e3ec7b708664bfad0702efee6

SHA256
2a6dd2804e610ddc02d1e295a659787fd6ced689fecd4b3befd54fc80237a174

SHA512
8dc2c3d39b1f9479e5cdb2934617713900ad388a3ca05f55a36ff53b9338104ac9dcf564e31dc18f872c90928b915b334a8c1b0e376ff3d9f642f7fe1f878e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe

Filesize
184KB

MD5
c56e4d0e09219b8086d87ddc24096a4c

SHA1
65bcc87ab2153972b9df9e985e268666bb0c115e

SHA256
7cb5441482f6c3f5012a632a60cabfa0a383c9d16f6c4b19cb497ed106407f44

SHA512
f2db39db4f950037d63579e303ad74aa71447900f719ac1f93b2b88f9ea49f20a96fdcbbf1a8e96c074bd746770cdca1fec6868773d71bcf1ab6fc4f6d9b9cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62747.exe

Filesize
184KB

MD5
b8ccb31e09491b47346c4729790c5896

SHA1
bbb8f7a3222cbb862eda19ae5fac55d080bfd955

SHA256
cd08af83733b4ebb251ee60333c27aaf2654d4b24a7baa5198a5868474fdb69d

SHA512
1fdb4bd1d084e72041185e5e6e3a49bd08f9a8a0221116e12b3696302f7ef207b0cc72b6efdec0e9ed6eae31fa183606e987af5c0385e408c2ed8562b7558204

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe

Filesize
184KB

MD5
7fd2e0a3013939232bde8252a29ceb15

SHA1
5af49e2af48d1d0d508a21bd1df5cb4a112fe15c

SHA256
3dd85093bf674fc2a327a7654327405f0d19619287a04f7e68fa0607daf0209a

SHA512
0c55f7c56cccfeccbc623867eb8ef2fb56863fdc33bb3456c6112d00e08151e1b3dd7a762ba6d351d03bc6e817353a5233b536dbdd042c6960b8164496b151a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63464.exe

Filesize
184KB

MD5
1bd58aeac9e954a944cef5acb507008b

SHA1
1c41fd047a111030ea3d901e9bce05552b181cf9

SHA256
7071daa2a6b8a23087465ce21de3288d919543a3794c769fefbb0364b0b817cc

SHA512
c8bd89753032008923dc479625fbdb84b46c50b9e52921bb2e6ecf26de12a92d9012401b93ca1d59a61fb13e34e20421966bb1bcf867d09f5ad6f973bab70a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe

Filesize
184KB

MD5
a986acb62b5462c44d99a2aa2def6398

SHA1
7f27c0809e3fec89d623cee31803b3178441ddeb

SHA256
98c729af728b72e705a2b6f336f7937cded59acb9b6427bfe8be94cebd26aaa2

SHA512
492e121917603340590ac26adabd917ca6c9c8b26663fae060b0976405c81c0bc200c4bf3e788327b7a93b315bf0bd6e47ffdc6a9e0d9ce5f15901544016fdae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe

Filesize
184KB

MD5
0b2fee2d633c0ae1a8f3b2936ae1122e

SHA1
543cd110f9fbde23cd7fa9a7e5b2f1c8f9d07ad9

SHA256
f8827a9ee9c516a603af3a2d65146e542868fa2dcdaafe2ec66c071731c7f4e2

SHA512
0e7369b8be3e6b878ec03558fe897049586712e777fca6b12c8ad635d08e4f099b80341a87d77310d39b60dc4f589ff66ededd994a89bd37eec34aeec4bdf9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe

Filesize
184KB

MD5
ec50db0189156e856e44babc90ad3cf2

SHA1
5df5a945d3f586434782d45a2a706e97bd119c7d

SHA256
700657d5afea17dc7953e9093605214d1ddacef188daad477f9a1c529816be1a

SHA512
20f601480b067d5802905f11ef674ac90bc648fad39e3edf5dcf0f5b7443f436e1d2957cdc85ef18b843d01f51477fd49b2ecb446a0403bd388e49eee8c3fda3

Download Submit
memory/1308-3651-0x00007FFB3A850000-0x00007FFB3AA45000-memory.dmp

Filesize
2.0MB

Download
memory/16504-2917-0x0000000076750000-0x0000000076870000-memory.dmp

Filesize
1.1MB

Download
memory/17196-3261-0x00007FFB3A850000-0x00007FFB3AA45000-memory.dmp

Filesize
2.0MB

Download
memory/17652-2808-0x00007FFB3A850000-0x00007FFB3AA45000-memory.dmp

Filesize
2.0MB

Download
memory/18208-3120-0x00007FFB3A850000-0x00007FFB3AA45000-memory.dmp

Filesize
2.0MB

Download
memory/18232-3105-0x00007FFB3A850000-0x00007FFB3AA45000-memory.dmp

Filesize
2.0MB

Download
memory/18692-3613-0x00007FFB3A440000-0x00007FFB3A4C3000-memory.dmp

Filesize
524KB

Download
memory/19348-3935-0x00000000761E0000-0x000000007625B000-memory.dmp

Filesize
492KB

Download
memory/19348-3934-0x00007FFB3A440000-0x00007FFB3A4C3000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads