20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe
Size

468KB
MD5

254c32f45490c0f1d40b133bb8b19220
SHA1

1445ed988bb5d9b481a31e1692846ed6f4c8984a
SHA256

20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40
SHA512

0bb9ce9dd14c80ea307d9c87a045dcc93f9d0de5f230fd1f9880bf1020fdf5c45d55d976f59b7ce8d2ae1b4fdd1ac47d6be4ac817ff067106b173aa6fac4fb50
SSDEEP

3072:trg9ogPxjF8U23Y9jz3yvf8/EChjy/pfdmHxvVpVak7+N7bNDjlu:traoguU2qjDyvfXRY9akaFbND

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
892	Unicorn-19305.exe
1636	Unicorn-59123.exe
928	Unicorn-12615.exe
1504	Unicorn-960.exe
1140	Unicorn-5044.exe
4176	Unicorn-64451.exe
1684	Unicorn-50716.exe
2516	Unicorn-16887.exe
4268	Unicorn-5381.exe
3716	Unicorn-29331.exe
4340	Unicorn-21717.exe
100	Unicorn-41318.exe
1516	Unicorn-45667.exe
3456	Unicorn-41583.exe
4136	Unicorn-43621.exe
4764	Unicorn-50903.exe
1856	Unicorn-9678.exe
3844	Unicorn-55350.exe
1004	Unicorn-26761.exe
1076	Unicorn-40497.exe
3204	Unicorn-22507.exe
4968	Unicorn-21936.exe
1768	Unicorn-30867.exe
1876	Unicorn-34951.exe
404	Unicorn-4224.exe
2288	Unicorn-19169.exe
4852	Unicorn-16477.exe
4040	Unicorn-20295.exe
4352	Unicorn-6262.exe
5068	Unicorn-58064.exe
208	Unicorn-2662.exe
3212	Unicorn-56502.exe
3668	Unicorn-12968.exe
1412	Unicorn-17053.exe
2936	Unicorn-31997.exe
2588	Unicorn-46273.exe
1708	Unicorn-42097.exe
4360	Unicorn-46181.exe
2152	Unicorn-50192.exe
4524	Unicorn-56579.exe
2284	Unicorn-40151.exe
2052	Unicorn-10363.exe
4920	Unicorn-30229.exe
988	Unicorn-11754.exe
4320	Unicorn-4333.exe
1656	Unicorn-41711.exe
216	Unicorn-44619.exe
888	Unicorn-36813.exe
3656	Unicorn-11562.exe
896	Unicorn-11562.exe
1012	Unicorn-6908.exe
3160	Unicorn-54733.exe
4960	Unicorn-9708.exe
1304	Unicorn-8225.exe
3676	Unicorn-28091.exe
3716	Unicorn-47120.exe
2520	Unicorn-36259.exe
2912	Unicorn-36259.exe
2432	Unicorn-34212.exe
1192	Unicorn-44162.exe
1524	Unicorn-24391.exe
1992	Unicorn-43419.exe
4392	Unicorn-63285.exe
4900	Unicorn-61239.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
768	3716	WerFault.exe	103
19224	15596	WerFault.exe	778
6620	17164	WerFault.exe	871
1620	17800	WerFault.exe	911

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1436	Process not Found
2060	Process not Found
8440	Process not Found
5092	Process not Found
1468	Process not Found
4964	Process not Found
6044	Process not Found
8416	Process not Found
8588	Process not Found
5960	Process not Found
6084	Process not Found
8592	Process not Found
8468	Process not Found
15644	Process not Found
17748	Process not Found
8516	Process not Found
16392	Process not Found
16564	Process not Found
15836	Process not Found
8608	Process not Found
4908	Process not Found
8524	Process not Found
8528	Process not Found
5304	Process not Found
17208	Process not Found
17744	Process not Found
16632	Process not Found
17780	Process not Found
8636	Process not Found
8640	Process not Found
8540	Process not Found
5996	Process not Found
16816	Process not Found
392	Process not Found
16060	Process not Found
8656	Process not Found
8616	Process not Found
18244	Process not Found
18324	Process not Found
16900	Process not Found
18236	Process not Found
8664	Process not Found
8724	Process not Found
5840	Process not Found
5196	Process not Found
5572	Process not Found
6200	Process not Found
6320	Process not Found
5552	Process not Found
5556	Process not Found
5636	Process not Found
5576	Process not Found
5256	Process not Found
5564	Process not Found
5280	Process not Found
8764	Process not Found
5528	Process not Found
6152	Process not Found
8836	Process not Found
5640	Process not Found
6308	Process not Found
5140	Process not Found
8892	Process not Found
7624	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16364	dwm.exe
Token: SeChangeNotifyPrivilege	16364	dwm.exe
Token: 33	16364	dwm.exe
Token: SeIncBasePriorityPrivilege	16364	dwm.exe
Token: SeCreateGlobalPrivilege	5720	dwm.exe
Token: SeChangeNotifyPrivilege	5720	dwm.exe
Token: 33	5720	dwm.exe
Token: SeIncBasePriorityPrivilege	5720	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe
892	Unicorn-19305.exe
1636	Unicorn-59123.exe
928	Unicorn-12615.exe
4176	Unicorn-64451.exe
1504	Unicorn-960.exe
1140	Unicorn-5044.exe
1684	Unicorn-50716.exe
2516	Unicorn-16887.exe
4268	Unicorn-5381.exe
3716	Unicorn-29331.exe
1516	Unicorn-45667.exe
4340	Unicorn-21717.exe
3456	Unicorn-41583.exe
100	Unicorn-41318.exe
4136	Unicorn-43621.exe
4764	Unicorn-50903.exe
1856	Unicorn-9678.exe
3844	Unicorn-55350.exe
1076	Unicorn-40497.exe
1004	Unicorn-26761.exe
3204	Unicorn-22507.exe
4968	Unicorn-21936.exe
1768	Unicorn-30867.exe
4352	Unicorn-6262.exe
2288	Unicorn-19169.exe
404	Unicorn-4224.exe
1876	Unicorn-34951.exe
5068	Unicorn-58064.exe
4040	Unicorn-20295.exe
4852	Unicorn-16477.exe
208	Unicorn-2662.exe
3212	Unicorn-56502.exe
3668	Unicorn-12968.exe
2936	Unicorn-31997.exe
1412	Unicorn-17053.exe
2588	Unicorn-46273.exe
4360	Unicorn-46181.exe
1708	Unicorn-42097.exe
2152	Unicorn-50192.exe
4524	Unicorn-56579.exe
2284	Unicorn-40151.exe
2052	Unicorn-10363.exe
4920	Unicorn-30229.exe
988	Unicorn-11754.exe
4320	Unicorn-4333.exe
1656	Unicorn-41711.exe
216	Unicorn-44619.exe
888	Unicorn-36813.exe
3656	Unicorn-11562.exe
1304	Unicorn-8225.exe
3676	Unicorn-28091.exe
896	Unicorn-11562.exe
4960	Unicorn-9708.exe
2520	Unicorn-36259.exe
2432	Unicorn-34212.exe
3160	Unicorn-54733.exe
1012	Unicorn-6908.exe
2912	Unicorn-36259.exe
3716	Unicorn-47120.exe
1192	Unicorn-44162.exe
1524	Unicorn-24391.exe
1992	Unicorn-43419.exe
4900	Unicorn-61239.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 892	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	89
PID 3552 wrote to memory of 892	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	89
PID 3552 wrote to memory of 892	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	89
PID 892 wrote to memory of 1636	892	Unicorn-19305.exe	92
PID 892 wrote to memory of 1636	892	Unicorn-19305.exe	92
PID 892 wrote to memory of 1636	892	Unicorn-19305.exe	92
PID 3552 wrote to memory of 928	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	93
PID 3552 wrote to memory of 928	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	93
PID 3552 wrote to memory of 928	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	93
PID 1636 wrote to memory of 1504	1636	Unicorn-59123.exe	97
PID 1636 wrote to memory of 1504	1636	Unicorn-59123.exe	97
PID 1636 wrote to memory of 1504	1636	Unicorn-59123.exe	97
PID 928 wrote to memory of 1140	928	Unicorn-12615.exe	99
PID 928 wrote to memory of 1140	928	Unicorn-12615.exe	99
PID 928 wrote to memory of 1140	928	Unicorn-12615.exe	99
PID 3552 wrote to memory of 4176	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	98
PID 3552 wrote to memory of 4176	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	98
PID 3552 wrote to memory of 4176	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	98
PID 892 wrote to memory of 1684	892	Unicorn-19305.exe	100
PID 892 wrote to memory of 1684	892	Unicorn-19305.exe	100
PID 892 wrote to memory of 1684	892	Unicorn-19305.exe	100
PID 1504 wrote to memory of 2516	1504	Unicorn-960.exe	101
PID 1504 wrote to memory of 2516	1504	Unicorn-960.exe	101
PID 1504 wrote to memory of 2516	1504	Unicorn-960.exe	101
PID 1636 wrote to memory of 4268	1636	Unicorn-59123.exe	102
PID 1636 wrote to memory of 4268	1636	Unicorn-59123.exe	102
PID 1636 wrote to memory of 4268	1636	Unicorn-59123.exe	102
PID 1140 wrote to memory of 3716	1140	Unicorn-5044.exe	103
PID 1140 wrote to memory of 3716	1140	Unicorn-5044.exe	103
PID 1140 wrote to memory of 3716	1140	Unicorn-5044.exe	103
PID 3552 wrote to memory of 100	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	105
PID 3552 wrote to memory of 100	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	105
PID 3552 wrote to memory of 100	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	105
PID 928 wrote to memory of 4340	928	Unicorn-12615.exe	104
PID 928 wrote to memory of 4340	928	Unicorn-12615.exe	104
PID 928 wrote to memory of 4340	928	Unicorn-12615.exe	104
PID 4176 wrote to memory of 3456	4176	Unicorn-64451.exe	106
PID 4176 wrote to memory of 3456	4176	Unicorn-64451.exe	106
PID 4176 wrote to memory of 3456	4176	Unicorn-64451.exe	106
PID 1684 wrote to memory of 1516	1684	Unicorn-50716.exe	107
PID 1684 wrote to memory of 1516	1684	Unicorn-50716.exe	107
PID 1684 wrote to memory of 1516	1684	Unicorn-50716.exe	107
PID 892 wrote to memory of 4136	892	Unicorn-19305.exe	108
PID 892 wrote to memory of 4136	892	Unicorn-19305.exe	108
PID 892 wrote to memory of 4136	892	Unicorn-19305.exe	108
PID 2516 wrote to memory of 4764	2516	Unicorn-16887.exe	109
PID 2516 wrote to memory of 4764	2516	Unicorn-16887.exe	109
PID 2516 wrote to memory of 4764	2516	Unicorn-16887.exe	109
PID 4268 wrote to memory of 1856	4268	Unicorn-5381.exe	110
PID 4268 wrote to memory of 1856	4268	Unicorn-5381.exe	110
PID 4268 wrote to memory of 1856	4268	Unicorn-5381.exe	110
PID 1504 wrote to memory of 3844	1504	Unicorn-960.exe	111
PID 1504 wrote to memory of 3844	1504	Unicorn-960.exe	111
PID 1504 wrote to memory of 3844	1504	Unicorn-960.exe	111
PID 1140 wrote to memory of 1004	1140	Unicorn-5044.exe	115
PID 1140 wrote to memory of 1004	1140	Unicorn-5044.exe	115
PID 1140 wrote to memory of 1004	1140	Unicorn-5044.exe	115
PID 1636 wrote to memory of 1076	1636	Unicorn-59123.exe	116
PID 1636 wrote to memory of 1076	1636	Unicorn-59123.exe	116
PID 1636 wrote to memory of 1076	1636	Unicorn-59123.exe	116
PID 100 wrote to memory of 3204	100	Unicorn-41318.exe	117
PID 100 wrote to memory of 3204	100	Unicorn-41318.exe	117
PID 100 wrote to memory of 3204	100	Unicorn-41318.exe	117
PID 3552 wrote to memory of 4968	3552	20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20d8541fc0f0febb4e5bd05f57e2e10fd94ec9612b45fbb9de04aaf4e16f8d40_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24391.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59341.exe
        10⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        11⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
        11⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        10⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28177.exe
        10⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        10⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28976.exe
        9⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        9⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
        9⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2372.exe
        10⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        10⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        9⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        9⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        9⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        10⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24281.exe
        10⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        9⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        9⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        9⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        9⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        8⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63171.exe
        8⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18516.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30478.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39919.exe
        7⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        7⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        9⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        10⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        10⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        9⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        9⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13036.exe
        9⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        9⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        9⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        8⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35594.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61304.exe
        7⤵
        
        PID:17640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55257.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        9⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33456.exe
        9⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        8⤵
        
        PID:18980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26607.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40628.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        7⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        6⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13017.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33575.exe
        9⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        10⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        9⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        9⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        9⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        9⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23217.exe
        8⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27234.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26493.exe
        7⤵
        
        PID:18268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        9⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        9⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
        9⤵
        
        PID:19192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51945.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11672.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        8⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        8⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33776.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        7⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        9⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58537.exe
        9⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        8⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        7⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        6⤵
        
        PID:18956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31329.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        8⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5859.exe
        7⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-327.exe
        6⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6280.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        6⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
        5⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24417.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45361.exe
        6⤵
        
        PID:15596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15596 -s 216
        7⤵
        Program crash
        
        PID:19224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-796.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
        5⤵
        
        PID:17776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        7⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42455.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
        9⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        10⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        10⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
        9⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        9⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65262.exe
        9⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        9⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        9⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37145.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35915.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        8⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        7⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        6⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        9⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        9⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        9⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20616.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        7⤵
        
        PID:16072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10140.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        8⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        7⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15871.exe
        6⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        8⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
        9⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        9⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        8⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33670.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5188.exe
        6⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        6⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25891.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        7⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7125.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9299.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11474.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32616.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
        5⤵
        
        PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40497.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18553.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        8⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38335.exe
        9⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
        9⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43113.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        7⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        7⤵
        
        PID:17580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15122.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        7⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        7⤵
        
        PID:18376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9594.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14878.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49808.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51649.exe
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        5⤵
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12688.exe
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        6⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2719.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        6⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45159.exe
        6⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53830.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        5⤵
        
        PID:18560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31739.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        5⤵
        
        PID:18420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48265.exe
      4⤵
      PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
      4⤵
      PID:10692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10407.exe
      4⤵
      PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54733.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51059.exe
        9⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22641.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        8⤵
        
        PID:18160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18146.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8225.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        8⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40461.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        7⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        6⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
        7⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51797.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        6⤵
        
        PID:17552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24531.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        7⤵
        
        PID:17396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62714.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        9⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        8⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42703.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        7⤵
        
        PID:19004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        6⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57400.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23545.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        5⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        6⤵
        
        PID:2416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        5⤵
        
        PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        7⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        7⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34207.exe
        6⤵
        
        PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12387.exe
        5⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24993.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44951.exe
        5⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30887.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59013.exe
        5⤵
        
        PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
      4⤵
      PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
      4⤵
      PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      PID:15856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7146.exe
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        9⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2735.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        7⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61303.exe
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44968.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58770.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5096.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18603.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50006.exe
        7⤵
        
        PID:18628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        5⤵
        
        PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44759.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35709.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55313.exe
        7⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
        6⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10435.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30730.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
        5⤵
        
        PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
      4⤵
      PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
      4⤵
      PID:17664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43773.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11426.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47582.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        5⤵
        
        PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21027.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38693.exe
        6⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15671.exe
        5⤵
        
        PID:18936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      4⤵
      PID:10148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
      4⤵
      PID:18928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5127.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        5⤵
        
        PID:19160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
      4⤵
      PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32134.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
      4⤵
      PID:17164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17164 -s 436
        5⤵
        Program crash
        
        PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
    3⤵
    PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
      4⤵
      PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42445.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19642.exe
        5⤵
        
        PID:17632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
      4⤵
      PID:16660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
    3⤵
    PID:9492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
    3⤵
    PID:14264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50920.exe
    3⤵
    PID:15688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 632
        5⤵
        Program crash
        
        PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        9⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        9⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34204.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        7⤵
        
        PID:17816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34775.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62350.exe
        7⤵
        
        PID:18456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56439.exe
        6⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27426.exe
        7⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42315.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63720.exe
        8⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26969.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        6⤵
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62866.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37572.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
        7⤵
        
        PID:17952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        6⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        6⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5689.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14442.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        6⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53368.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64847.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65501.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        5⤵
        
        PID:18948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6377.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45710.exe
      4⤵
      PID:14368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        8⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        8⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        6⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        7⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20333.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47307.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11520.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57115.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51687.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53249.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2247.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53866.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10810.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45723.exe
        5⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        5⤵
        
        PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        6⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29228.exe
        7⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
      4⤵
      PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64303.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40684.exe
      4⤵
      PID:17696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26389.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35813.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        7⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59232.exe
        6⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54982.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8556.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        5⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57952.exe
        5⤵
        
        PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39117.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55936.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9978.exe
      4⤵
      PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-421.exe
        5⤵
        
        PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17099.exe
      4⤵
      PID:12764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61863.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45112.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5994.exe
        6⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
      4⤵
      PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2382.exe
        5⤵
        
        PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
      4⤵
      PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53136.exe
      4⤵
      PID:18188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
    3⤵
    PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64302.exe
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
      4⤵
      PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
    3⤵
    PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33648.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8964.exe
    3⤵
    PID:12732
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45771.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5241.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15341.exe
        7⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        7⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
        6⤵
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45413.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46429.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        6⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
        7⤵
        
        PID:18988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        6⤵
        
        PID:17844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3434.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34229.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10025.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41282.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44145.exe
        5⤵
        
        PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
        7⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
        7⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        6⤵
        
        PID:12928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        6⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        6⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12081.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5292.exe
        5⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18251.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12871.exe
        5⤵
        
        PID:18996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64795.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        6⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        7⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61417.exe
        6⤵
        
        PID:16256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7893.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        5⤵
        
        PID:19012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
      4⤵
      PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
      4⤵
      PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13264.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28338.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61780.exe
        6⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34032.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43882.exe
        5⤵
        
        PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40155.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        6⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20232.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25875.exe
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10424.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7390.exe
        5⤵
        
        PID:17788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38158.exe
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12487.exe
      4⤵
      PID:18388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
      4⤵
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40566.exe
        5⤵
        
        PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63218.exe
        5⤵
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36721.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
      4⤵
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53144.exe
        5⤵
        
        PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
      4⤵
      PID:15676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
    3⤵
    PID:8960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57436.exe
    3⤵
    PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27024.exe
    3⤵
    PID:17756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2216.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3752.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62543.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51998.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
        6⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        7⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        6⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14432.exe
        6⤵
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        5⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51931.exe
        6⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14634.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60020.exe
        6⤵
        
        PID:17800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17800 -s 464
        7⤵
        Program crash
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        5⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32492.exe
        6⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18016.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12202.exe
      4⤵
      PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10363.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45849.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34342.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
        5⤵
        
        PID:18596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46082.exe
      4⤵
      PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
      4⤵
      PID:14672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
    3⤵
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35163.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30452.exe
      4⤵
      PID:14688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57514.exe
    3⤵
    PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40499.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
      4⤵
      PID:17500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
    3⤵
    PID:10824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
    3⤵
    PID:14280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21681.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23161.exe
        5⤵
        
        PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
      4⤵
      PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
      4⤵
      PID:17368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8770.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        6⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49330.exe
        6⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4411.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9080.exe
    3⤵
    PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56020.exe
      4⤵
      PID:14196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
      4⤵
      PID:12980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
    3⤵
    PID:9456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
    3⤵
    PID:14800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9958.exe
    3⤵
    PID:17744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41711.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14354.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
      4⤵
      PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39294.exe
        5⤵
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16470.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
      4⤵
      PID:17916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23331.exe
    3⤵
    PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27925.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
    3⤵
    PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45054.exe
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17898.exe
    3⤵
    PID:15524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
  2⤵
  PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      4⤵
      PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
      4⤵
      PID:17964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23431.exe
    3⤵
    PID:15616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56052.exe
  2⤵
  PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40753.exe
    3⤵
    PID:11552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
    3⤵
    PID:15740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
  2⤵
  PID:10836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
  2⤵
  PID:14840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3716 -ip 3716
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 15596 -ip 15596
1⤵
PID:15624

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16364

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 16544 -ip 16544
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 17368 -ip 17368
1⤵
PID:748

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4536

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1920

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:6256

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:6288

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\f92b4aff93b54e13a0e0b087169e2d3f /t 1832 /p 4924
1⤵
PID:18588

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\6273ddb776874166bc5363ee3191dcbd /t 3952 /p 3924
1⤵
PID:5884

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:7000

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:6408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:6060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12615.exe

Filesize
468KB

MD5
7fb3735bf57173d863ad35ce3c5dde62

SHA1
db200d607fa65c95242bc65467dfc0f0753ba3f4

SHA256
a42044f28dd4712718f145fc23b4c1d3e3cacd6f18ddc38e073fb4da815cec04

SHA512
a20ce8e90984d12c7edd7802b5fb5f30db98df8e67db4bcef82dd8f5ba3069c1f8fb3a5a08dccd14dabae7b6cb8e0c8028e25740352a23a6e0c1fcc0e3dd5018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe

Filesize
468KB

MD5
bf1b2d7bdddee5992b329a198f715ac1

SHA1
1acbfe455346987649715543bde1190c604827a9

SHA256
cfab74891d8b435eec4280f8f479f80c2cda0db620f879d263bc69d599c85f40

SHA512
0a3fe4c6aba8743c6cffa662a3304250c3a641f8dac5ba195904787e857debda9f6c4e775fc9028af8bf7753a2839dcd3769ef94534353e83cf11ed516a64cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe

Filesize
468KB

MD5
645f39883c3a64117860ab5010235e18

SHA1
cd305b9e655732fbf860c60e7db8780c514bc395

SHA256
8d20e55e9bdf91185a67e92098bf487fa9ed1d26e73679eb9516d50a24c3ba13

SHA512
d26c519b8549b9dd84d176076c1d6b5619fa3a473614efed8bfbc650eedb09bbe937d72777427acd6b62665517f64a00fe76d701a7470d29d8d705977f2e18fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe

Filesize
468KB

MD5
a2a891e417c8e48a6919a98de36cf86d

SHA1
e84d366ba7fa2033db85385b97bb7724b2955c9a

SHA256
63bff4fdd5bf462fb39b6baf7654e5c4a656c604ea2cfbf8f34364d0fcd7191c

SHA512
5fee484ee0ed934471c441721c026375e0a9c1a02b60153b8bcfd712c8b9a3e6d09bf85c71311fc3181fe7fdcb6a60d97eee100901c657a2f81f18a0a65b8a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe

Filesize
468KB

MD5
a1fe7522bff104fee21f9613ce01dd1f

SHA1
71c3045a5eed8c6025b57daed8a9c9fabcca48bd

SHA256
70987a384dad43deb28a91d69ef2301ba9c4daacc40edce102f0dd71832cce96

SHA512
bbed383dd547fbfd3b5e1f153555244d2d047810d756c5c99655ac83b1b475e5aba9a0642fbf3f676cf73c8d2a134c80f88be8f4f14770a4d5166be684593172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe

Filesize
468KB

MD5
e32deee02084916a3b83221598971496

SHA1
fe7070fe6f5f4950be55aa431fadb94b7e1ea005

SHA256
5206faeef136edfae078379f4038a0e526c81a1dee639df520ebff2c76689397

SHA512
5928ec0b315e7dab8695311e192334c541091d8a26826a6f1111bfd88a49f19447fd15164a268891145d6ff568cbc617999edb800e1b47669982f508dcab6ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe

Filesize
468KB

MD5
54aa248a0e24dcb36ae498bba33a4ac5

SHA1
53c87b018941e69ab581dd2dde2015ad01dc817f

SHA256
64ea1d4eaa89d14334698273b92915f10cc08c0e1ad84970b77c50311c784903

SHA512
298c06e7666576f361d4eb29d22eeee427ba00191eacc6446b8715550dca4af7b8da929433ba8ba3ede23aab2da346a1fc1e1adca48bab660e7b9b5a72d391b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21717.exe

Filesize
468KB

MD5
7b88584198084c9b134b54ee889810b8

SHA1
ce46f15a75511466f491283e870f59d274181c7a

SHA256
4abe8e4bc86138425810654d398cbe515f1456b789a012c3079afc7180b029c5

SHA512
4fddd18c03887e65f5c53bb382bff84e18123587b2c904bcb32cd36fcd3a793e9882c4c5485048dd366cb52bf1978ead05a96180a5604c2aee6043a87fd9df8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe

Filesize
468KB

MD5
3266d6f1096bbdf5bd5970d3c4effd80

SHA1
1510b42f99b9458e190dc0b6490c3d8137744568

SHA256
944c9dd54db8a373b9789553925b1ef6b45b0bd1c638130c722f6d53481695c4

SHA512
81a3c585da6defcd74a76a26e530e23d00950ccaf902003a42c1fdb440f2e929d9088729500afb61718dc0b234a0634267890e46ef8fea9130088268226690b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22507.exe

Filesize
468KB

MD5
816dc6b4fc1c921d6ea544938fca9c7e

SHA1
f69f751c8a50b6826a49827ee73a05db628d2e6c

SHA256
64025b8516d5d6de35281a3087b5a169a2e79a2644b2e23c926a94b4b70dc3df

SHA512
e369339eab2738f89f88e9ae014c929b9864831b88343df14886a0005420eb214fbf031254bd378677d9da9f4552db617717fc9d8c91234340fa9b481fbdfe69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe

Filesize
468KB

MD5
fb7daef68f82c823965b2135cd170ed7

SHA1
ab724d9917ab19fa897b00748b32df6aedf5b6ea

SHA256
e08b3e3ceef3dd4ff812211f05ca7795b3797f5f2650afefff2eb0d7bb3bb0cc

SHA512
fe9f3a8c93cce3a81b5f0497f7d1ba0da8cb2ff0092cf7be1905c3ab04ddf3160a3feab92d0026177cfd7b9e43f38c763e7f5988feef61d46dfbfa643f98c3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe

Filesize
468KB

MD5
cf20c27c645ecb542c5fe38449e91bd5

SHA1
17b067a577e64b54e527d35beecd903946d6d306

SHA256
e4774ff330861313ef33e3ac1505bc58751e549a233b614b3c1c080dbf28de39

SHA512
80956373debd3a8cb8aba53dc167fc700991ef9542a874ce9a58781738512276d92e4ae77bf272a674a12c27b01a073a0cfdbdcd2d8f7a78e588f1761f204896

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe

Filesize
468KB

MD5
371c4658e039f52f7b1dd48a4fd8f58a

SHA1
fd4359d24757e159f0286547884534a2a490cea9

SHA256
c8aa4dfb019b3af463bb34df0da068d0fa7e954610827ed38f2d6bbcdbe50071

SHA512
7c8885ec12c4b45d1180a5b094b543bd7637f6d5b993ab333605c178f1f183f87d7706836ec20b8654e1907c0a3110e96a9ba158af5abb6e48b85defc8d36045

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe

Filesize
468KB

MD5
ab81bd2b587858a1435de40d7e36ecee

SHA1
f517abecf06da870de96bf94f1d06b6154f04893

SHA256
2d284077058f06794de47bee9b58751c5d3930bdabf49eca5e6d9a9659c427f5

SHA512
a6a629d42ce162618d91727663dfbb7d8c2462b32e8fd6a391371f3bdedf4822af97ed9cda97de06f67bc4b95d39f142a3293d0d02ad8d34c6e1fc8e35b1033f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe

Filesize
468KB

MD5
0c3d821d4e605af14928b0c0b7107fa7

SHA1
ac98f29296636b3f1c09636cde976e7f59549b27

SHA256
19593b021d8365978d1b2267b8dcef483031b086e02411e44b473e1b14749839

SHA512
5079b5c5c0bbe36230abacc83a919814de7a2ac0cdd85fba68f02606a9808d049d02699f25d13f833a308750d161223c95e0b1600916c850761f71f9679187fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40497.exe

Filesize
468KB

MD5
07f6ac7e342fee0413af4d2894e44ebb

SHA1
dce0d7de5ff282edc7e6a3d63d1cf976acc70d83

SHA256
9f4e33a0b79987f31d954a2c853ae11d5f2c43797f2066201eaef2802aa4cb93

SHA512
2a9a52a46d454100a8cebe8f8144226cdf6a5819f55f84bf6bc1c098a46bd2b07e6f31527edb4da844bc99b3a18fe97b6ec396a9c2ed98d4c595056a4553caf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe

Filesize
468KB

MD5
411dd2f10693b831fce5f59817af3c5c

SHA1
e61245d3b3dba4b7a0bdd7e9dcdb4590d2553d42

SHA256
44b94e0433f23c8877968ee5b4ab087a6c55f9b9a4f0a60b44bb4ac53a1a641c

SHA512
71f4c82ba1ecadf0720d7f2cbca055ab6b12b9b16cf0bb8edcf56f265e637dc7be456912e0f7fd2ba0c80d33c67d5827918a0cbdace6a08571e3bad785d54da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe

Filesize
468KB

MD5
7f791812e04cc9aa90c7a228edee94ce

SHA1
831c6c05998853681d9fcd6e32d0f21af68ea4a9

SHA256
a37fd7b0b1a670b24503f8bc5c7bf8ce12a8b2d11568b0f995ea15fa3e43316b

SHA512
3a5f512f2a4f68bd8bd609b57707e8c2cdcd863874d694878ed07983e1616796a887c5fde1a1bead1cd774471158f5ebc9db9dafae479a876d19d74080dc5ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe

Filesize
468KB

MD5
0061203c3428589c7feb3abca50a27d5

SHA1
088bdfd4c927538e4bccfdf40530eb7c4bb5e91e

SHA256
64554a9fde2725f205e8cd12f113fb90f26d2f866e372599a93f9c3a76a0852e

SHA512
ff9b927a3c663cf9cce6f915002df8dd993c8e807f979871c980df30e7c10bbe6eda38f098bcb49a63a83b3b1a9d45e30f96fe9f8214c41eb541076b51f4f6b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe

Filesize
468KB

MD5
7f2292e0dac4949a8ee1b9c351164049

SHA1
0dc052f368c7a6e46cdcb126c8b9a5eb0a20b34a

SHA256
3c7f00f747e1c0abc57c9be63e5b4f487cd121870fc429276f15386fae5cb4f2

SHA512
4005bd87a0f4bfb3cc241a1ae983c28c66c4e1efa2e86f9ac4be3df3f4cd2e2f81b5ee09480cf8dbce814c78e434024ac198de4391b6f6553ac8d974c135d8e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe

Filesize
468KB

MD5
6d0da11098d968e05b19eb8f187026d4

SHA1
3d7178ac3a02a6f6442213bfb40c6967e339e8d1

SHA256
b19f7e1f04417a9a952097ee7eced42d3163bf76b415922609f6ac5bb7fbe78d

SHA512
447cdc9963f58373a4ea4fb489eec5c186ffb93223a45585e23ac5417a0b565e557bf264436d95466237e0509fb0c56bc0b45cbab48c6b2f7fc365f8057b494d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe

Filesize
468KB

MD5
666748fcbd24d4c3946ed2b8310f5088

SHA1
38f777ea8c279c6a830a9cec45e428452e323572

SHA256
2cdd45e17caaaf854e122f9a705280f5fbc5500d9fb00b5e6b5ba50e33131434

SHA512
3eb836eaad3fc9641fd939001d4eb0a2d5254c1b62b33a1d1b8f1773631c473ab9041f16cacf806c7bbf0f235bb3cf8cc092f5b74fe8a16c1fe755a77b6fc438

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe

Filesize
468KB

MD5
e0a4851945b4978fbec4da210f09ffce

SHA1
dd3989e7a9ab2477e7bd8ce6472b9db8bc036e5c

SHA256
48057bcac1ea1369a403790cd52a18f5790ea69abcad35d2db76dd2fbfb0cde9

SHA512
ffc9ac15879619b216cb0c311064cf02de39c3d07a73af152decf11c0e24b28d1c0fe3e16916c4c276df4cc5afb41b70f7f2d4070004f796510d39a03249eaa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe

Filesize
468KB

MD5
cc39f324415b4725410c31ab57cafb8d

SHA1
d12a30db1873b5ed8b226f75096b0313e61cfde4

SHA256
e98dbc8b3be7262975c63e3c02bab879df83211ab170409a340d050b242f51a7

SHA512
9a3b00074ad030472a288d4b1c31e8165f86e8c2608d0111bef132d8eddd772b90a6152cce7bee3a72d7b7935e392484839c8177511f9abebe6d47910abc5e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe

Filesize
468KB

MD5
4952060fbac6dbc51e47c3e43beb7e66

SHA1
f8276027fed2ae64196d527325cd6fd405a52c4c

SHA256
4564507bdb0f427df3c259a77f64c1ac3717fc276112c21b9d3d0c62760c48b6

SHA512
624cbce7c7eca357b18b41de4f94a4ab396cdf5072eeb12c7a539ab0ef9dec6f4ff8002d2b61079f1e785908b5b69196dd894d530df6a693c273dd528f64bbf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe

Filesize
468KB

MD5
f018c11dfd128fda2e213febc5d21116

SHA1
7c7d58bb980ced99741dbb65419ec746a824a582

SHA256
3183e5ba8b603ff7edb2a6335a6657a49a9be159faee605c96e756d4ed02c64d

SHA512
34c58c1a24f038b3d6589461f235f5e4cb41bf102fcacad82ab545254d1c783ae9a7083d6e7dbd1358e3e803ec1f979a68986de5140d02967f0143b273281a0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe

Filesize
468KB

MD5
085e05b2a2b91595e207b2b7bd161442

SHA1
af255e1776c7ad3aa275ab967b67bfa4422f836f

SHA256
0d9ff0be0b511f0a80adad6b7978be2862a004da63ff932148c79ae31e3abe74

SHA512
1ed413a1e9789b12214bebab10b43b7edaf1460389b35474238baf25f5ac61692e7a72c5c860843f07feda7a19bf86c25713a24fe207f3b433b25dc1cda7927f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58064.exe

Filesize
468KB

MD5
e3c7ed1380b8f477dffa8fd9feb23c75

SHA1
5b336169d22bbe53b0969c6ce32913963a9320c7

SHA256
5d4ffb96ad535b6c6f2043a9283d53370bbaa3c39a078ef937fa8715d2e1a57c

SHA512
8ec1eca1dc58091daecc0dc4552c434734e517bf9f26d654a1e2476e396a8006c96e7139011b4b58f0d72934a82228b9316d2f39f825f6f47b5950ef8f315e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59123.exe

Filesize
468KB

MD5
d8cf44d86e9c6b257697fb767e45b0ce

SHA1
f0219d21cdd864b74bb9bf7ec1e68ee293c36bd7

SHA256
43d717695699b6b99751d1e05558165f9f4805d529e7c0f69ccbce6f38413dc5

SHA512
c905b28e34d9e0f9c156a5adf080523940819e30c09bf0df7c422fa64714e90820ba725af03f41115d34db3ad1530f5f2500a46e6eaed0ddecee8db3eefa337b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe

Filesize
468KB

MD5
0ac85e6dcbdc00d486046c9c9db83f01

SHA1
832395644a0ca6ab507e2533e00b9e59739649ab

SHA256
e23f16a384735efb7f57f4579ee02d9a952f398f2570d3f3b2611af58c8bb739

SHA512
14cb8fc5a346e076a23f2db350ad115200343ab2204102e9fe4c984bad65b0b3ee58b2084db59fb6478559cf9d0eeef325b572cda68ed47669aafed648d0032b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe

Filesize
468KB

MD5
0befe30a34f27978a4bcc7cad26f7b5b

SHA1
dd89a23c1dc46cd9f9061a3d6de6682e71bb0dfc

SHA256
b271f7784dfe72d27e02584e09a6012d35b0cb1b2ffa6b46d7cd6bf64bea780d

SHA512
39cfba2272ae4a4884d2d0e281a78bb9529794cf61130079a2b1912416560937d4fa83e88e1c869b855605cdf6994e633d0421ced339aed72560236c2d441302

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-960.exe

Filesize
468KB

MD5
843bd303bbc24409ae67cbf59061be06

SHA1
83267387cebc914f3e9c766eeeca6eff131cb256

SHA256
ca73c759bab03a7a2c87522321054a888d84ed7e42c134c16be9734ecfb94224

SHA512
c72dd19e166096637ed378b98f37e469e53516d4dde1543fdfcbc1f6556857cb14dd90050b80cfc245e7b73005b7bd90cd72daa8404152e0f3992c574d19f402

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9678.exe

Filesize
468KB

MD5
6b5d789b0a0a00b4631ab6d17c6a1baa

SHA1
1152a01faea71a9c8b00701c8a852736385aa85f

SHA256
6df2080b401f63ea9203316a1e3be760c7a84fbea1d895f3eba4369a77c29c6e

SHA512
d83a328c3aba5481bc63e77e3a29eb9552c2abac83dda7cf177529db85f579f995b6b8ad6db1c38282f534db8508b97e4732f7d5f047405d0be30b0108dbe3f7

Download Submit
memory/100-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/896-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/988-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1076-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1768-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-3140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2520-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3656-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4040-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5500-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5788-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5872-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6104-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15640-3197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16560-3196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads