4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 11:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe
Size

184KB
MD5

75682fb8ebcae7be5153ff6633cf34d0
SHA1

ba24a23d65b301337f7c581f9602bb57b3b2c73e
SHA256

4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3
SHA512

51524b645edc03b632c5e8de2920a022667f68db8c40f9398f090f52af835a21b4d7847c39c9b3d7ad88650ed6d56518ccf3b1116a883f9157f3e3aa7239b766
SSDEEP

3072:dARDXEo1pZPOUdTkIsp4zxp3o9vnqnpiuZ:dAqoYQTkEzv3o9Pqnpiu

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 64 IoCs

pid	Process
4764	Unicorn-45418.exe
4444	Unicorn-10773.exe
2536	Unicorn-52169.exe
3236	Unicorn-29222.exe
2980	Unicorn-21054.exe
4404	Unicorn-14923.exe
4820	Unicorn-58557.exe
1560	Unicorn-12413.exe
1012	Unicorn-49917.exe
3124	Unicorn-53254.exe
4892	Unicorn-45086.exe
2892	Unicorn-25220.exe
1964	Unicorn-45086.exe
5040	Unicorn-36653.exe
3136	Unicorn-30787.exe
4432	Unicorn-22694.exe
228	Unicorn-10441.exe
948	Unicorn-23248.exe
2348	Unicorn-36984.exe
1556	Unicorn-14141.exe
4572	Unicorn-51645.exe
4124	Unicorn-50898.exe
3132	Unicorn-46814.exe
1960	Unicorn-35641.exe
2228	Unicorn-35906.exe
388	Unicorn-35906.exe
4400	Unicorn-29775.exe
1000	Unicorn-3788.exe
3892	Unicorn-23654.exe
464	Unicorn-61157.exe
1324	Unicorn-14723.exe
3612	Unicorn-24770.exe
2700	Unicorn-45937.exe
3356	Unicorn-61718.exe
4480	Unicorn-21240.exe
2836	Unicorn-8241.exe
4604	Unicorn-4157.exe
4884	Unicorn-55396.exe
2108	Unicorn-61261.exe
2016	Unicorn-62870.exe
4668	Unicorn-10140.exe
2352	Unicorn-30006.exe
2088	Unicorn-30006.exe
2376	Unicorn-35936.exe
4872	Unicorn-14032.exe
1260	Unicorn-10353.exe
1056	Unicorn-2185.exe
4508	Unicorn-59362.exe
3264	Unicorn-55278.exe
4364	Unicorn-31328.exe
3160	Unicorn-31328.exe
3272	Unicorn-24643.exe
5076	Unicorn-21843.exe
5072	Unicorn-30774.exe
3712	Unicorn-10908.exe
1608	Unicorn-10908.exe
3408	Unicorn-12199.exe
2208	Unicorn-18064.exe
4744	Unicorn-58401.exe
2344	Unicorn-55662.exe
1772	Unicorn-19460.exe
3268	Unicorn-30966.exe
3576	Unicorn-20058.exe
2216	Unicorn-1675.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
9012	6752	WerFault.exe	241
11948	8404	WerFault.exe	345
8024	16704	WerFault.exe	999
5804	16716	WerFault.exe	998
8524	9756	WerFault.exe	1001

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
17004	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	7664	explorer.exe
Token: SeCreatePagefilePrivilege	7664	explorer.exe
Token: SeShutdownPrivilege	7664	explorer.exe
Token: SeCreatePagefilePrivilege	7664	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	sihost.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe
4764	Unicorn-45418.exe
2536	Unicorn-52169.exe
4444	Unicorn-10773.exe
3236	Unicorn-29222.exe
2980	Unicorn-21054.exe
4404	Unicorn-14923.exe
4820	Unicorn-58557.exe
1560	Unicorn-12413.exe
1012	Unicorn-49917.exe
3124	Unicorn-53254.exe
4892	Unicorn-45086.exe
1964	Unicorn-45086.exe
3136	Unicorn-30787.exe
2892	Unicorn-25220.exe
5040	Unicorn-36653.exe
4432	Unicorn-22694.exe
228	Unicorn-10441.exe
2348	Unicorn-36984.exe
948	Unicorn-23248.exe
1556	Unicorn-14141.exe
4572	Unicorn-51645.exe
4124	Unicorn-50898.exe
3132	Unicorn-46814.exe
3892	Unicorn-23654.exe
2228	Unicorn-35906.exe
4400	Unicorn-29775.exe
1960	Unicorn-35641.exe
388	Unicorn-35906.exe
1000	Unicorn-3788.exe
1324	Unicorn-14723.exe
464	Unicorn-61157.exe
3612	Unicorn-24770.exe
2700	Unicorn-45937.exe
3356	Unicorn-61718.exe
4480	Unicorn-21240.exe
2836	Unicorn-8241.exe
4604	Unicorn-4157.exe
2108	Unicorn-61261.exe
4884	Unicorn-55396.exe
2016	Unicorn-62870.exe
2088	Unicorn-30006.exe
2352	Unicorn-30006.exe
4668	Unicorn-10140.exe
2376	Unicorn-35936.exe
4872	Unicorn-14032.exe
1260	Unicorn-10353.exe
1056	Unicorn-2185.exe
4508	Unicorn-59362.exe
3160	Unicorn-31328.exe
3264	Unicorn-55278.exe
5076	Unicorn-21843.exe
4364	Unicorn-31328.exe
3712	Unicorn-10908.exe
5072	Unicorn-30774.exe
3272	Unicorn-24643.exe
1608	Unicorn-10908.exe
2208	Unicorn-18064.exe
3408	Unicorn-12199.exe
4744	Unicorn-58401.exe
2344	Unicorn-55662.exe
1772	Unicorn-19460.exe
1716	Unicorn-53477.exe
2216	Unicorn-1675.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4764	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	89
PID 4268 wrote to memory of 4764	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	89
PID 4268 wrote to memory of 4764	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	89
PID 4764 wrote to memory of 4444	4764	Unicorn-45418.exe	92
PID 4764 wrote to memory of 4444	4764	Unicorn-45418.exe	92
PID 4764 wrote to memory of 4444	4764	Unicorn-45418.exe	92
PID 4268 wrote to memory of 2536	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	93
PID 4268 wrote to memory of 2536	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	93
PID 4268 wrote to memory of 2536	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	93
PID 2536 wrote to memory of 3236	2536	Unicorn-52169.exe	96
PID 2536 wrote to memory of 3236	2536	Unicorn-52169.exe	96
PID 2536 wrote to memory of 3236	2536	Unicorn-52169.exe	96
PID 4268 wrote to memory of 4404	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	97
PID 4268 wrote to memory of 4404	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	97
PID 4268 wrote to memory of 4404	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	97
PID 4444 wrote to memory of 2980	4444	Unicorn-10773.exe	98
PID 4444 wrote to memory of 2980	4444	Unicorn-10773.exe	98
PID 4444 wrote to memory of 2980	4444	Unicorn-10773.exe	98
PID 4764 wrote to memory of 4820	4764	Unicorn-45418.exe	99
PID 4764 wrote to memory of 4820	4764	Unicorn-45418.exe	99
PID 4764 wrote to memory of 4820	4764	Unicorn-45418.exe	99
PID 3236 wrote to memory of 1560	3236	Unicorn-29222.exe	100
PID 3236 wrote to memory of 1560	3236	Unicorn-29222.exe	100
PID 3236 wrote to memory of 1560	3236	Unicorn-29222.exe	100
PID 2536 wrote to memory of 1012	2536	Unicorn-52169.exe	101
PID 2536 wrote to memory of 1012	2536	Unicorn-52169.exe	101
PID 2536 wrote to memory of 1012	2536	Unicorn-52169.exe	101
PID 2980 wrote to memory of 3124	2980	Unicorn-21054.exe	102
PID 2980 wrote to memory of 3124	2980	Unicorn-21054.exe	102
PID 2980 wrote to memory of 3124	2980	Unicorn-21054.exe	102
PID 4404 wrote to memory of 4892	4404	Unicorn-14923.exe	103
PID 4404 wrote to memory of 4892	4404	Unicorn-14923.exe	103
PID 4404 wrote to memory of 4892	4404	Unicorn-14923.exe	103
PID 4820 wrote to memory of 1964	4820	Unicorn-58557.exe	105
PID 4820 wrote to memory of 1964	4820	Unicorn-58557.exe	105
PID 4820 wrote to memory of 1964	4820	Unicorn-58557.exe	105
PID 4444 wrote to memory of 2892	4444	Unicorn-10773.exe	104
PID 4444 wrote to memory of 2892	4444	Unicorn-10773.exe	104
PID 4444 wrote to memory of 2892	4444	Unicorn-10773.exe	104
PID 4268 wrote to memory of 5040	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	106
PID 4268 wrote to memory of 5040	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	106
PID 4268 wrote to memory of 5040	4268	4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe	106
PID 4764 wrote to memory of 3136	4764	Unicorn-45418.exe	107
PID 4764 wrote to memory of 3136	4764	Unicorn-45418.exe	107
PID 4764 wrote to memory of 3136	4764	Unicorn-45418.exe	107
PID 1560 wrote to memory of 4432	1560	Unicorn-12413.exe	108
PID 1560 wrote to memory of 4432	1560	Unicorn-12413.exe	108
PID 1560 wrote to memory of 4432	1560	Unicorn-12413.exe	108
PID 1012 wrote to memory of 228	1012	Unicorn-49917.exe	109
PID 1012 wrote to memory of 228	1012	Unicorn-49917.exe	109
PID 1012 wrote to memory of 228	1012	Unicorn-49917.exe	109
PID 3236 wrote to memory of 948	3236	Unicorn-29222.exe	110
PID 3236 wrote to memory of 948	3236	Unicorn-29222.exe	110
PID 3236 wrote to memory of 948	3236	Unicorn-29222.exe	110
PID 2536 wrote to memory of 2348	2536	Unicorn-52169.exe	111
PID 2536 wrote to memory of 2348	2536	Unicorn-52169.exe	111
PID 2536 wrote to memory of 2348	2536	Unicorn-52169.exe	111
PID 4892 wrote to memory of 1556	4892	Unicorn-45086.exe	112
PID 4892 wrote to memory of 1556	4892	Unicorn-45086.exe	112
PID 4892 wrote to memory of 1556	4892	Unicorn-45086.exe	112
PID 4404 wrote to memory of 4572	4404	Unicorn-14923.exe	113
PID 4404 wrote to memory of 4572	4404	Unicorn-14923.exe	113
PID 4404 wrote to memory of 4572	4404	Unicorn-14923.exe	113
PID 3136 wrote to memory of 4124	3136	Unicorn-30787.exe	114

C:\Users\Admin\AppData\Local\Temp\4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe
"C:\Users\Admin\AppData\Local\Temp\4963b283ef11e5b3de496c06312ab0e08aaebdb11fdd24b2d8192f281fde48f3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45418.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45418.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10353.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        9⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41978.exe
        10⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52829.exe
        10⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        10⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        9⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        9⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        9⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62206.exe
        9⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        9⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        9⤵
        
        PID:18764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3907.exe
        8⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
        9⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        9⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        9⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        8⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        9⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        9⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        9⤵
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        9⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        8⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50553.exe
        8⤵
        
        PID:18848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        8⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39392.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30456.exe
        7⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        7⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        7⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        7⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        6⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        8⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42709.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        7⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59098.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7283.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22549.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        6⤵
        
        PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        7⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61630.exe
        8⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23612.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        7⤵
        
        PID:16904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40110.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        7⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        7⤵
        
        PID:18820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44233.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        6⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        5⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10177.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        6⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2192.exe
        6⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        5⤵
        
        PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7141.exe
        7⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 636
        8⤵
        Program crash
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29599.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60841.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        7⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        7⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
        7⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35071.exe
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27968.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31328.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        8⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        7⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        6⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        6⤵
        
        PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27139.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23737.exe
        5⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
        6⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13883.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10592.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58781.exe
        6⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        6⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        6⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25996.exe
        5⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3465.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        6⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        6⤵
        
        PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3803.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55014.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        6⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
        5⤵
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        6⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        5⤵
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14567.exe
      4⤵
      PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2185.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        9⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        9⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        9⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7084.exe
        8⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51956.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        7⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        7⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25724.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        6⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        6⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        7⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40788.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        6⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        6⤵
        
        PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41408.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35744.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-712.exe
        5⤵
        
        PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60124.exe
        7⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        7⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47966.exe
        6⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
        6⤵
        
        PID:19120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20944.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55148.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        7⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7887.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2051.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
      4⤵
      PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
      4⤵
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45330.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        8⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        9⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48561.exe
        9⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
        9⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        7⤵
        
        PID:16604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37436.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        7⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33248.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17474.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61381.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        7⤵
        
        PID:17232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        6⤵
        
        PID:18400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        6⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8935.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        6⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25865.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64924.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        7⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        6⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
        6⤵
        
        PID:16832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-933.exe
        6⤵
        
        PID:18544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        5⤵
        
        PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46984.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        6⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        5⤵
        
        PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35413.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        5⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        5⤵
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
      4⤵
      PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        6⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        5⤵
        
        PID:18752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        5⤵
        
        PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50073.exe
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52280.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
      4⤵
      PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        5⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        5⤵
        
        PID:15708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
      4⤵
      PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25309.exe
      4⤵
      PID:17416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
      4⤵
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
      4⤵
      PID:9484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1420.exe
      4⤵
      PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
      4⤵
      PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
    3⤵
    PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
      4⤵
      PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21471.exe
    3⤵
    PID:11052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
    3⤵
    PID:15224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52669.exe
    3⤵
    PID:1488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55662.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55034.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        9⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        9⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        9⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        9⤵
        
        PID:19084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        8⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        8⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        8⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        7⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        9⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        9⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        9⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        8⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        8⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        8⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2444.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48712.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41736.exe
        8⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23966.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62542.exe
        7⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52730.exe
        6⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25412.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6595.exe
        7⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
        7⤵
        
        PID:18860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        7⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26179.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        8⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 436
        9⤵
        Program crash
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        8⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14240.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37872.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        6⤵
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21190.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        7⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35642.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21852.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        5⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        5⤵
        
        PID:18928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        8⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16928.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        8⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5967.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29433.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:17520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10820.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13294.exe
        8⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        7⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
        7⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7058.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        7⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        7⤵
        
        PID:18960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12304.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        5⤵
        
        PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55396.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52253.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        7⤵
        
        PID:18836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13560.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63885.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        6⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62201.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
        6⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        5⤵
        
        PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47806.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        7⤵
        
        PID:19208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13096.exe
        5⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        5⤵
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        5⤵
        
        PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36740.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
      4⤵
      PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
      4⤵
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30966.exe
        6⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        9⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        9⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        8⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-643.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45324.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34859.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        7⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42376.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        7⤵
        
        PID:16704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16704 -s 436
        8⤵
        Program crash
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5177.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21978.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        7⤵
        
        PID:18812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65257.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        6⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        6⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49521.exe
        7⤵
        
        PID:16984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
        6⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48469.exe
        5⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        5⤵
        Executes dropped EXE
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46470.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        8⤵
        
        PID:19184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        7⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16196.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6264.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2187.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        6⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64104.exe
        5⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42001.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54837.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48780.exe
        5⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43146.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12112.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54253.exe
        6⤵
        
        PID:16716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16716 -s 464
        7⤵
        Program crash
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16107.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37025.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        5⤵
        
        PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2408.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        5⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        5⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
      4⤵
      PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3929.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        5⤵
        
        PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2968.exe
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      4⤵
      PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62741.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
      4⤵
      PID:18828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8241.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        7⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        7⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        7⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-923.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49085.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        6⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11675.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        5⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52901.exe
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        6⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39557.exe
        7⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26212.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        6⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47812.exe
        5⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12797.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        5⤵
        
        PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42097.exe
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56556.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
      4⤵
      PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
      4⤵
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
      4⤵
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15444.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46209.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55909.exe
        6⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        5⤵
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61173.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63462.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24512.exe
        6⤵
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55856.exe
        5⤵
        
        PID:14996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
        5⤵
        
        PID:16840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      4⤵
      PID:8404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8404 -s 636
        5⤵
        Program crash
        
        PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37679.exe
      4⤵
      PID:16340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
      4⤵
      PID:18052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6467.exe
    3⤵
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29652.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        5⤵
        
        PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
      4⤵
      PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46977.exe
      4⤵
      PID:18092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
    3⤵
    PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54666.exe
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      4⤵
      PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
      4⤵
      PID:18020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
    3⤵
    PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
    3⤵
    PID:12692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
    3⤵
    PID:16128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
    3⤵
    PID:16668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        6⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        9⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17232.exe
        9⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14504.exe
        9⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        8⤵
        
        PID:19180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        7⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        7⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55220.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9798.exe
        6⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29446.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53221.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7409.exe
        7⤵
        
        PID:19256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38448.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        6⤵
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44821.exe
        6⤵
        
        PID:19140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31905.exe
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
        5⤵
        
        PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48174.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21527.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55338.exe
        7⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        6⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64483.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63109.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52175.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        6⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51580.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        5⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61864.exe
        6⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42893.exe
        5⤵
        
        PID:18072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57214.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        6⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        5⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        5⤵
        
        PID:18732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62257.exe
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41954.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
      4⤵
      PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56754.exe
      4⤵
      PID:16760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64562.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        7⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60736.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        6⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6528.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56076.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        5⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19512.exe
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
        5⤵
        
        PID:18952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        5⤵
        
        PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
      4⤵
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        5⤵
        
        PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
      4⤵
      PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1093.exe
      4⤵
      PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35936.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        6⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        5⤵
        
        PID:19268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45450.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        5⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63645.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17628.exe
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      4⤵
      PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
    3⤵
    PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57878.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        5⤵
        
        PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15260.exe
      4⤵
      PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      4⤵
      PID:18804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
    3⤵
    PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
      4⤵
      PID:11844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34720.exe
      4⤵
      PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37725.exe
      4⤵
      PID:18060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62885.exe
    3⤵
    PID:10800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
    3⤵
    PID:15036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    3⤵
    PID:3608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36653.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35014.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60250.exe
        8⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        8⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10651.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        7⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        6⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        5⤵
        
        PID:10972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        5⤵
        
        PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13787.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        5⤵
        
        PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15959.exe
      4⤵
      PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5768.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12398.exe
      4⤵
      PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38612.exe
        6⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49593.exe
        6⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
        5⤵
        
        PID:16544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34791.exe
      4⤵
      PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41744.exe
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
      4⤵
      PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
    3⤵
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23856.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27696.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
      4⤵
      PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42528.exe
      4⤵
      PID:9736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
    3⤵
    PID:8016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24888.exe
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
    3⤵
    PID:9084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46285.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62745.exe
        5⤵
        
        PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45272.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20880.exe
      4⤵
      PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      4⤵
      PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38444.exe
      4⤵
      PID:18868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      4⤵
      PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19802.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20533.exe
        5⤵
        
        PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61224.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      4⤵
      PID:15708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
      4⤵
      PID:19132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13752.exe
    3⤵
    PID:7416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48440.exe
    3⤵
    PID:11796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53804.exe
    3⤵
    PID:3148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
    3⤵
    PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48278.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        5⤵
        
        PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32941.exe
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
    3⤵
    PID:6240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40612.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
    3⤵
    PID:15056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21712.exe
    3⤵
    PID:1420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
  2⤵
  PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57162.exe
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
      4⤵
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
      4⤵
      PID:900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53737.exe
    3⤵
    PID:10224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
    3⤵
    PID:13620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60870.exe
    3⤵
    PID:6432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55523.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55523.exe
  2⤵
  PID:7484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16136.exe
  2⤵
  PID:11004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
  2⤵
  PID:15296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
  2⤵
  PID:17344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6752 -ip 6752
1⤵
PID:8780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8404 -ip 8404
1⤵
PID:11928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:17004

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:1192
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Suspicious use of AdjustPrivilegeToken
  PID:7664

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\d5694f289cf24a9d8cce99c9a91c1b09 /t 2968 /p 4356
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 16704 -ip 16704
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16716 -ip 16716
1⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 9756 -ip 9756
1⤵
PID:8232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe

Filesize
184KB

MD5
da5b2d87a3d5dfb8fb2703fe93c81d66

SHA1
5500442d3e2fe97932583058bd67809471c21276

SHA256
acc263462a88cf62fb6f02d9cd7ff6fa4c37172cced5c81849411c89fbc91deb

SHA512
46e81a8bd65dda5c5176d0c7fba76752fe3006bf3fe8ff6f1eedd7b2aaed31f43b25d9a26d8f14b848053532df7aa370271503bc284913fa2ab50a5105bf7405

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe

Filesize
184KB

MD5
76f43d7977f1b6ea172f29646105bda4

SHA1
20733fcf7d3e2152c708f59464884675400ea971

SHA256
89b5cd60dc4c83df4079d7fe5a4ec2ec0d5b40857fd78d24e79e39bcee7c78ee

SHA512
4e0219236396491d19882f53d503759917253c644fc7440920a021307f1d2f1e53f73fe457763c0ad55b0d96681cb9f4f0fc6464684b2355d04a04faeee8e6d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe

Filesize
184KB

MD5
bfca3cd0e26df971f68a7373f950fe75

SHA1
53cf7de7bd6bfbdbfbcccc36a0a3246e662c3a87

SHA256
56e97f17e70458a13e2aceaee19990a1ba9e902696907023b9ea5c16b8a5f96a

SHA512
7c054f6a4d8ab3134ec02cf2285112971886661d24938d7d12418a8701abc5530f7be37619f8275398c79f6f1ae3d5c54a0ebbe47b208b6a0fa42d5df3c9855a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14141.exe

Filesize
184KB

MD5
bfd84450b7d930d9a2ca05fe7a301389

SHA1
75328626769032ab60a4c0f317e0186873f7aa41

SHA256
ff6ef854349a8584624f0db08364e540a22c6919fd4d4127de50472e58d777b3

SHA512
280c0f8de93f8d634a2621aca28aacc27b1c3d6a930dd4fbcf4f1727472b9cafee270f3bea498d3d302fda086f2396ce7b80fcfd6b1e3c727559d697238d1e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe

Filesize
184KB

MD5
bad33595c4ba75fcbe02ef1c07618ab9

SHA1
de49de38be26c4a680718806ba7853c4c1379b80

SHA256
2b3b2d87dfb649ee97a631f0ebb1d2974303e3fc89b472d8989113bf7b8d3d6e

SHA512
87db5a7e3c185cf163315dac6eda1c72e51c7ea90a6c4095365eb8e85aa8c35cd9094121626355276b9e87beefcd519aab241fb715c16b68b4ed1e550246c27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14923.exe

Filesize
184KB

MD5
6591457eb004c14f6283620995bc8afa

SHA1
3281b123600d9da743615bbe0b1a1a8ca66fe21c

SHA256
208b485a9c6a05564b5386677d2cbd02fdd1b52d4878ee747c498b530a2abc3e

SHA512
5b4916435a897c95c9681c2f09a09da489ca1658e2fcb7623c4b8ddbc3dfccfe573f4c6000274fb043a6ce183d614dc0ce69f7d6768325e47d2c797830562c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17709.exe

Filesize
184KB

MD5
5430a8ec752eb121509e9637c084604f

SHA1
6b3ecbccf41eb9c779ba28614f512006b77a2e1b

SHA256
565546f0a67e793e0f5600ac87d5e1abc48f226d054789756af1147c657fee4d

SHA512
543ec8f1e659601045d7dbe3757b0f0754b3ad43502bc605e7efede91662523d52c10dba9611c4102a1ddec6a031bd730b63d5375e8cca75021b47d3b255a9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe

Filesize
184KB

MD5
fb30421798c46e46b36295ff4b633684

SHA1
607fa1bcb7874f49dff93be92f5768a9a61cb611

SHA256
0c2f6a318e133769d7dd7c21a3f86b2702703085516753365fd3b5f3a24cf5c2

SHA512
4abab9a1c432fad088546c19a59bb179bebfde09abe99ad13dd20d8737b80b3a847d997b17f37900ed8cdd2e6cc4a2d3d818ed64468f142904693e36af096892

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe

Filesize
184KB

MD5
50c139b36191cdd73815357a4f1ef0ed

SHA1
6ee2d0874a7f0a663bb4bac0f1ac7a612a2ae163

SHA256
9dca0fc016832ebbec6e4a9e5c8cc47b95be35c59933624347a61bf6e3d04d53

SHA512
b1ebdc6d35bbf951c7fe2112650d245cb4fca03f543eb6cacdab9cc3a5697f1d032b36e6280398a6382f05dbe937e5cb6bf3efcab12cf7c042fa4be058f68c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe

Filesize
184KB

MD5
38bc04da769b09437567e68dfeab68a6

SHA1
bae5b98c881248e02da0b77e84e743f2892a122c

SHA256
3763082ae7e8b9d470fcfcc61ca8aa7c89a1a28b90eaf7ade474adbffdb58f52

SHA512
2658e634bc9683e46d3a83412bd673eb308a5e7eb96cb5ee8fdfd3ca3d9a3765a8ccca4169fa7dc7c074de72bd98cb3e9b3fad4c7d9e516f0656d6f53bf89048

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe

Filesize
184KB

MD5
52a64dc47e6370e9262eee2867f2fbf0

SHA1
55c29f29b761beffcb5b081c4ab32ba0275040ba

SHA256
2cc1da0a21279be258fe30b12c1891e39b13b46d4b5ebc06109617dce36b0d09

SHA512
a783f09a5376858d12d5290a0cef1938905f98701ae08bc25b29d9edd08fe89b7a2fda6f5087a4d04bd40832f951c906ba43bd27c00c5a477346b3f83b510cc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe

Filesize
184KB

MD5
3909f30b529adad12a58ec3296f8d300

SHA1
21136ad5e2b66e77d84ba64200f863173a527eb3

SHA256
afe51939e6bade59905ce9c02eaa2d53c587aba7cb9fd9361448c705815990f4

SHA512
c9532ecf065482265dd0cbd9754ed8de79debb42888b3644e1a806627297b73a47897a2233efbbff05fbcecc48baf8e088f48c892afa851591a198fe688af274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe

Filesize
184KB

MD5
e6c0094a575b0361471cd48f1e54b40f

SHA1
16f195991a23864447e92226d1ac3442083f269c

SHA256
86b25f6985a1642883541275f8ebaa02dd7764b13e7cf1def945906691428eae

SHA512
9d6e8b630577b9f2bf206f926250874d88853ea751fa44dfc460c0d92abfce4f9c4b7cce82f6b3e3135000898f6e4807c03189fb9ad575f45dc8df17cf65aaaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29222.exe

Filesize
184KB

MD5
d4fe921418ff357aea47392af06a9442

SHA1
c3b84355b38d78a6c70beedf1445861344cb6c75

SHA256
04d6821968a5e76e6b684b79d2bf194b1fccba38cf92ec8abfbbc91e29116bb3

SHA512
77695150034304eca6fa88b3bd68e73fec4f616a115fc6f307d667ebe4d4dd86a166873074a688f1d540ecca111f96ff19ab6eb24f61c26c8cd64c30bac9933d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe

Filesize
184KB

MD5
818eb8376e7b9bfee2e60d19765de1ab

SHA1
d90479dd57ce6de9de23a59353e03f162960062c

SHA256
4bdedd5625609b84b8db498b3fbb389618130b0ee6c8fc79a1877048fde4d851

SHA512
7dc5d36288eec3efeac16b28004d195012b911621a86e7fcdb655e0f8d0932b4e87508ee5cfb4043adcd4f756eb1d4f1ff374bf611dacc27de8e93d30795d3c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe

Filesize
184KB

MD5
e2d0b40384cdf3be85e03ace2a583396

SHA1
704100b7b21738904025ba293dd2b63172e71d87

SHA256
00bdc642988bdd589b871638c56b94a363ff8a240a669f3db3f515294aa2cb22

SHA512
ac70fe969566868c23621509caf85629b9b65e28a40d424d1756b0936adf5aab772f65106abcc51a6aca205af15edb08dba6cadfafbdfcfbc6f7ed4a35cbd998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30787.exe

Filesize
184KB

MD5
c54ad079a4edebfd2fa7e228276f212a

SHA1
d8b72955eacf427783ff13cb4b3e44d30c9e2b9e

SHA256
82f50873aaa4477c2fe3611d1dfcfc061eb2f767da175c16269a76e13d99cd5c

SHA512
67948a9260cf1890583080c2243497f28961e59269f50d0e96994492684394c9d335115a3205fbb4855d6dc5728c28e8635435f391b930bd7fe6d4f2e492cbae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe

Filesize
184KB

MD5
7f4c2be4a76ee039394ce2c857d71ffe

SHA1
86aceb05c2a1d2bc9c36e5a776a4350389e9b965

SHA256
cd0b68c66f6f8e699496eb94e1818ef21284aee4ae224e04584a60dad350124c

SHA512
6a95e28e9456a89ee0b6bd843a0cc071ca8d05597091455b168163366190cf02030f2f2667d97ffd75574127b825241ef2080933e8d9a9332e36adb86c703fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe

Filesize
184KB

MD5
69fafbbbe9fc76e315ea0981f043123d

SHA1
ff006e18c72b707e19cf5db7af41e444dbfa4048

SHA256
3852f70869ffaabd5b93aa355d39c8fc5b0f0a184039694c1677199af604e66b

SHA512
38b707216734a390258e0d28c646e1b539e1ef9ec0e55d61f24999ae59c8ad51fdff4893435c53b68351ef16ec78f9ad4382d354d3d46e3c73d09dd9eeedafa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36653.exe

Filesize
184KB

MD5
f7793f10d8562617316b56d10fa8c1c5

SHA1
3a153d0ecb34266da1f3e6f6cc1a6be53b968511

SHA256
49205bece5a34b07b79424157b611e8d6063e87238574762eecb1f5ae719be54

SHA512
8a4e8de89a0a6f90befb91df44fe978c90f279cac0fb396f71a43901e6a9e61c4257e719cbf83965639bcd8f4fadaab82318dfc9772339d8bb2bf39d95e28936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe

Filesize
184KB

MD5
73a968674c251002d793d4775054b67d

SHA1
de9e0548f21480c6989ad52a699936985a4bb2ac

SHA256
59e0b8be8ba04b5c886d0aee2b4fbbd0b7d61a34bacaff4f57c187f686bd6cab

SHA512
03154da26af2f347d4db0b7bc684d5ef558aeb8c53ea220672360cf247968703ae81bcf9dd72ca56bbda41c633537a59aefa0e1578c0872ab4b5fa6592a31918

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3788.exe

Filesize
184KB

MD5
4b228548be4a6079a3fdf0b4c71884a1

SHA1
2df7072e0f6124fe73ab80e765bdb86a56b465de

SHA256
8ef02ede272c57c638825fba6dcdca88c386a0aeee82561d4450fb7a54649dc5

SHA512
78d17579988893847d3635d4c1113b0952fa4f589a608f0082bee0db127de9f4872006f6da1ff388d1bcdbf7967b39511e154afc41a0aa28e2f542ddfb0bc579

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe

Filesize
184KB

MD5
c7f0c1e401d52d23d0a2831f8732de11

SHA1
bee140280eb8b323b6502f4925982f046bf8354c

SHA256
567040159412f7cdfe66fd35837e8ca62ecd15bca61881ecabcff336ff23c3dc

SHA512
56c3730a8c558fc8feee5c0e806e2a16ac4183e8ec4a9753e6853fa903f5ed710ca2236cc35ea2afd18656bd9e55751373b777af20955d76ac58c99bc02dee58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4136.exe

Filesize
184KB

MD5
1a80a4490849c7e97d4e0ff6f9985b3c

SHA1
c3311e0c84fa936e1db97c715763205ca945f685

SHA256
536802f9039d8abf67ea71839ecec428b0a70a879d25f9f245e7e7ad8fcb1aa0

SHA512
6894d05e252ff136790ca174e3da14950d0df16a84c6ed6de47cb15fee4c8a086cca8f6126a81a91955c9b40874c495da1bb4efd89e31d5b3d0619cbb914fc7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe

Filesize
184KB

MD5
1b026e6d3af817287e5bd491d30b16f6

SHA1
246785b789da9347dd341df6c2b0111a119f544c

SHA256
36b6d94ac3138ada001d9cefc84cb9bb1ae76b42855cd531544dce8a6f4dfc08

SHA512
ec417f078664b8ac69da9884a583f17d0b92d6aa0c0e83533bc396e882ffc9a7f74a7248210a5ca08d78dba921dd907f68b31c692c53f6b69218094099910888

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45418.exe

Filesize
184KB

MD5
4e4881eff1f5fb88bace2a1bd88f6f48

SHA1
684023c55d07d8d0bec239485d292790bc66339e

SHA256
05c9a0508c99378121341aa33388e0949e2aaf5f1fd53b8eadab3a1f9d1a7bd9

SHA512
c095eabfb0b5d154d41a5f290618dbc8c3a0f9ec7a5d1af92d6e01e87a1a68e3fd69d55c554a235da7aa389d6d7c82f061da44c8d23abcd1b94abd4ae51ba1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe

Filesize
184KB

MD5
b7730b414bc6f4cde57a52b341524374

SHA1
8eb1069242ea98a847b449f88ccf0726c56b0625

SHA256
c7806e432c824f661c51c733352f5d9399e1c08d1c5df322590e6d6cc84f6a39

SHA512
de7f1398dccaaf2657c9fe8151352b8dfa9b7d560d9cf5294b8554eeb8395d114542ca637057c6e6cb039bb3244ad86fe1a626b19ae9b8c82b9f1a3ce3734be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46814.exe

Filesize
184KB

MD5
111b618fd4158f27b4860ba9c39b3ad7

SHA1
ce6f7adb26bf5cb2d4e2f03ab938f6fa382a0809

SHA256
662cab0dfce929a0ce755c3499353e4fd4626fd06c7e3502dfcda26738803854

SHA512
23e78f51087a5779ddfc55e64002fdf36a3bdcd312eb3fe4f663cd972ffead2647199513a6c78b8815d834bebe2ddddcc9ed1a9b23deb62c11bf9ff2d02df1c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe

Filesize
184KB

MD5
1f06fb74a8e07be46fd0d0232d08d50d

SHA1
9f11fdb84b75fdb5c913717f38edb0a0f5c69015

SHA256
b3763e1a3c0192a7b798dbb6b15f3d0301f0d6242aea3202f0b729f145fde029

SHA512
aef1b537051392e1736157e5a060fba8c2e225380c01b4b82d99b22f8775383687be820bc4f35e5909b3c7c785c50be8f490c556851c072a296710aa855c8004

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50898.exe

Filesize
184KB

MD5
28bd07f93b6aa39324532117fc5283e8

SHA1
cd3e31fb548231bcdcc88a5307c97a85be3eb494

SHA256
c303ca91df0e7e3bc6d54fa27839b433a209712275779a4d1df6eb1987c82021

SHA512
b646fd250a5d19dceeb449d0b0c9805ba88d6438f3e6c4c93fc9c162298272b453e8de111a06a9e73124731515a582455f7588b19d1c067489216843ddd7a391

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe

Filesize
184KB

MD5
219983e1f4c1130244ccc6d5da98f8f2

SHA1
11a59d894686759bca2e493ebf08b96fc05cc81d

SHA256
d7dfd055ac6660fecb41e17475c325e1811270cfe8dc67269a7d3b5e450fdc18

SHA512
a197001584ccab9dcbecf401458cfb829d4183643b2558dd96cf3303d89ddb751460afdfaf44fd6369c316199028ab3b9987c6646fbaee090cc066198ef70210

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52169.exe

Filesize
184KB

MD5
b9e4d2252cba3914fb88e652ac97cbdb

SHA1
581f2e06ab954a5540482394f20bbc13f832a2f2

SHA256
f4f2285892ac95e8468a6e2fbfe27cb0505f38300439a00548b4cf1c3a0db815

SHA512
8caa37bf3d026e75428bdbb66344f1205a506ee481476c77ee0370608cdaf256a6696b5975f7aef0de56da73d44f85500d8532602e166e670ed6af8b1e867317

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe

Filesize
184KB

MD5
ff673a8111163fda8869baea338f20db

SHA1
5710bb455acac5988600c30b4fc490458ac310b4

SHA256
c0d23d62af1242b342b56fefce48069fa62481ac59e1e51221dbbdaa275fa743

SHA512
7f3414f86be0b6a3e83f33ff5879e9b3d36fce3fb3d09a261bb9074ee9158ab39564f74d8e963bf2154808aff121f4ce0204c996ee4fd334df8f738abc9b9ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe

Filesize
184KB

MD5
a55e63797abb017a0167382a20ddd7f6

SHA1
8a98b9841efc0585a91a1d126e619c5c877d82f9

SHA256
1dc9f5c09492d980a10d70d62be316226854256e56942222fc82044dcc4f6a5a

SHA512
0f11a346da1d74235f6429ec26912d0384cece1cf8cae5da917f07de9b8ef3988bfb3fa4998f1b935e7d72f8909c4cd564bbecc841ce5d05adf6c5d69c7225e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61157.exe

Filesize
184KB

MD5
23093ae1781d2650eae734b4d3c6a949

SHA1
173775524b047ffef431095c6ec604622dbae197

SHA256
56d69f493f2f3b09b490798bf54c4d9b8332beb6ba72d4830412fb54e2f19848

SHA512
8d74d8992658dc19813ed8ab995b37820097be314f01b6f39e3df4e8c4ebbc7ddd6b655215964005ced28e5bba4fc4ecc71dab87eafbdeccc747da6d32da9e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6513.exe

Filesize
184KB

MD5
7e738c306eec439930453895a9522eaa

SHA1
9b04d0572ef3bc1bf2aeb28ad901ea1bdaf04dd5

SHA256
fbed96f8305f9fb95892421236959196ab797aabe2e67ed0886218a3b85d393f

SHA512
61a1816003a0c9994f03ef6c8c20b8e6696a9331083b4199c73a38113edf726e6c4a1c8c49e5d9f5687287fedcfa30b95adaf5e90b8bc1de27ef4a758ebebc9f

Download Submit
memory/228-114-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/464-188-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/948-123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1000-186-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1012-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1044-407-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1056-295-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1260-290-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1324-204-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1556-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1560-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1716-372-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1772-355-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1960-174-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2016-255-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2088-273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2108-245-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2208-335-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2216-370-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2228-176-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2344-352-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2348-126-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2352-270-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2376-274-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2436-384-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2536-20-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2700-223-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2836-242-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2892-83-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2980-41-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3124-74-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3132-173-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3136-91-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3236-27-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3264-307-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3268-366-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3272-317-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3304-393-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3312-403-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3356-224-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3380-4766-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3408-323-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3576-368-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3612-213-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3712-322-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3892-187-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4124-151-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4268-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4344-409-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4364-308-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4400-177-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4404-42-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4432-108-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4444-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4480-230-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4508-306-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4572-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4604-243-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4668-264-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4744-339-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4764-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4776-402-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4820-45-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4872-275-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4892-82-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5040-92-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5048-386-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5072-321-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5076-318-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5164-416-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5272-432-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5288-441-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5304-452-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5324-446-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5344-447-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5360-448-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5376-449-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5408-453-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5456-466-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5564-478-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5612-479-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5616-484-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5656-483-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5700-485-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5820-501-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5860-518-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5880-519-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5888-528-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5924-529-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5944-530-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5968-531-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5992-532-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6000-533-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6028-551-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6056-552-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6084-534-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6128-537-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/7304-4743-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/7664-5051-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/8496-4760-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/9756-5052-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/12608-5393-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15984-3255-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17256-3164-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads