0cdb5c019ffeb14be3d6774e032f4ff0fd5bb3539b614199c4ce5c14ff47b127

Analysis

max time kernel
116s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39cb8c3bbc52c9711a619dd9e58c9a80N.exe
Size

184KB
MD5

39cb8c3bbc52c9711a619dd9e58c9a80
SHA1

0beb980b4c32431a8f152fb226df84deeba13c86
SHA256

0cdb5c019ffeb14be3d6774e032f4ff0fd5bb3539b614199c4ce5c14ff47b127
SHA512

089971673673420c16f517e43585ab1ab94a32c4caad7b05bbbb822c6a8e4285ebea05d2bd518e263e312a46501ab25133620e8cbc45a780b6593221f661f2d4
SSDEEP

3072:RyZaYeo0y5vNdn+tZQFWt5KQlvnqnveuX:Ry+odbn+QWbKQlPqnveu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4400	Unicorn-40235.exe
5016	Unicorn-4630.exe
2080	Unicorn-54386.exe
2796	Unicorn-24833.exe
4512	Unicorn-39777.exe
4412	Unicorn-53513.exe
4608	Unicorn-36845.exe
404	Unicorn-32106.exe
1680	Unicorn-48351.exe
3312	Unicorn-21709.exe
1204	Unicorn-29612.exe
3052	Unicorn-10011.exe
4748	Unicorn-24807.exe
2780	Unicorn-22760.exe
3204	Unicorn-10416.exe
5064	Unicorn-14235.exe
4492	Unicorn-27521.exe
2340	Unicorn-15823.exe
872	Unicorn-878.exe
4256	Unicorn-34926.exe
1444	Unicorn-47941.exe
1556	Unicorn-47941.exe
1836	Unicorn-62694.exe
2112	Unicorn-49787.exe
3616	Unicorn-30583.exe
4016	Unicorn-30583.exe
2324	Unicorn-38678.exe
5000	Unicorn-19077.exe
2056	Unicorn-16385.exe
1736	Unicorn-47111.exe
2652	Unicorn-27874.exe
1524	Unicorn-16939.exe
1252	Unicorn-46919.exe
4372	Unicorn-39305.exe
1936	Unicorn-12492.exe
3908	Unicorn-31521.exe
4972	Unicorn-55471.exe
2268	Unicorn-59555.exe
3320	Unicorn-41657.exe
4708	Unicorn-52518.exe
4516	Unicorn-52518.exe
2052	Unicorn-8884.exe
4964	Unicorn-19099.exe
2004	Unicorn-57993.exe
4824	Unicorn-27267.exe
3680	Unicorn-9969.exe
3560	Unicorn-35170.exe
4808	Unicorn-33580.exe
4628	Unicorn-48071.exe
5108	Unicorn-22559.exe
3244	Unicorn-23951.exe
4656	Unicorn-16337.exe
852	Unicorn-54485.exe
2840	Unicorn-58569.exe
1996	Unicorn-46872.exe
4424	Unicorn-25796.exe
2760	Unicorn-21813.exe
2280	Unicorn-19488.exe
2356	Unicorn-63229.exe
3404	Unicorn-28419.exe
2844	Unicorn-35003.exe
3468	Unicorn-48739.exe
2836	Unicorn-193.exe
640	Unicorn-41655.exe

Program crash 23 IoCs

pid	pid_target	Process	procid_target
7716	5248	WerFault.exe	215
16344	14328	WerFault.exe	692
3564	10268	WerFault.exe	701
16316	13248	WerFault.exe	700
5632	2224	WerFault.exe	688
5812	12524	WerFault.exe	698
6032	13860	WerFault.exe	705
2964	14784	WerFault.exe	717
16264	15100	WerFault.exe	722
216	15180	WerFault.exe	723
6056	12308	WerFault.exe	726
6064	15212	WerFault.exe	750
14472	4420	WerFault.exe	736
14508	14600	WerFault.exe	734
12984	14948	WerFault.exe	744
3612	15248	WerFault.exe	752
14296	14752	WerFault.exe	733
14292	15124	WerFault.exe	747
16192	13424	WerFault.exe	704
15856	15180	WerFault.exe	723
1616	1676	WerFault.exe	762
8188	15124	WerFault.exe	747
6212	776	WerFault.exe	757

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe
4400	Unicorn-40235.exe
2080	Unicorn-54386.exe
5016	Unicorn-4630.exe
2796	Unicorn-24833.exe
4412	Unicorn-53513.exe
4608	Unicorn-36845.exe
404	Unicorn-32106.exe
1680	Unicorn-48351.exe
1204	Unicorn-29612.exe
3312	Unicorn-21709.exe
3052	Unicorn-10011.exe
4748	Unicorn-24807.exe
2780	Unicorn-22760.exe
3204	Unicorn-10416.exe
5064	Unicorn-14235.exe
4492	Unicorn-27521.exe
2340	Unicorn-15823.exe
872	Unicorn-878.exe
1444	Unicorn-47941.exe
1556	Unicorn-47941.exe
1836	Unicorn-62694.exe
2112	Unicorn-49787.exe
4256	Unicorn-34926.exe
3616	Unicorn-30583.exe
4016	Unicorn-30583.exe
2056	Unicorn-16385.exe
5000	Unicorn-19077.exe
2324	Unicorn-38678.exe
1524	Unicorn-16939.exe
1736	Unicorn-47111.exe
2652	Unicorn-27874.exe
1252	Unicorn-46919.exe
4372	Unicorn-39305.exe
1936	Unicorn-12492.exe
4972	Unicorn-55471.exe
3908	Unicorn-31521.exe
4708	Unicorn-52518.exe
3320	Unicorn-41657.exe
4516	Unicorn-52518.exe
2268	Unicorn-59555.exe
2052	Unicorn-8884.exe
3680	Unicorn-9969.exe
4964	Unicorn-19099.exe
4808	Unicorn-33580.exe
3560	Unicorn-35170.exe
4824	Unicorn-27267.exe
2004	Unicorn-57993.exe
4628	Unicorn-48071.exe
5108	Unicorn-22559.exe
4656	Unicorn-16337.exe
3244	Unicorn-23951.exe
852	Unicorn-54485.exe
1996	Unicorn-46872.exe
4424	Unicorn-25796.exe
2760	Unicorn-21813.exe
2840	Unicorn-58569.exe
3404	Unicorn-28419.exe
2356	Unicorn-63229.exe
2280	Unicorn-19488.exe
3468	Unicorn-48739.exe
2844	Unicorn-35003.exe
2836	Unicorn-193.exe
4296	Unicorn-38625.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4400	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	86
PID 3488 wrote to memory of 4400	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	86
PID 3488 wrote to memory of 4400	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	86
PID 4400 wrote to memory of 5016	4400	Unicorn-40235.exe	87
PID 4400 wrote to memory of 5016	4400	Unicorn-40235.exe	87
PID 4400 wrote to memory of 5016	4400	Unicorn-40235.exe	87
PID 3488 wrote to memory of 2080	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	88
PID 3488 wrote to memory of 2080	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	88
PID 3488 wrote to memory of 2080	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	88
PID 2080 wrote to memory of 2796	2080	Unicorn-54386.exe	89
PID 2080 wrote to memory of 2796	2080	Unicorn-54386.exe	89
PID 2080 wrote to memory of 2796	2080	Unicorn-54386.exe	89
PID 4400 wrote to memory of 4512	4400	Unicorn-40235.exe	90
PID 4400 wrote to memory of 4512	4400	Unicorn-40235.exe	90
PID 4400 wrote to memory of 4512	4400	Unicorn-40235.exe	90
PID 3488 wrote to memory of 4412	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	91
PID 3488 wrote to memory of 4412	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	91
PID 3488 wrote to memory of 4412	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	91
PID 5016 wrote to memory of 4608	5016	Unicorn-4630.exe	92
PID 5016 wrote to memory of 4608	5016	Unicorn-4630.exe	92
PID 5016 wrote to memory of 4608	5016	Unicorn-4630.exe	92
PID 4400 wrote to memory of 404	4400	Unicorn-40235.exe	93
PID 4400 wrote to memory of 404	4400	Unicorn-40235.exe	93
PID 4400 wrote to memory of 404	4400	Unicorn-40235.exe	93
PID 2796 wrote to memory of 1680	2796	Unicorn-24833.exe	94
PID 2796 wrote to memory of 1680	2796	Unicorn-24833.exe	94
PID 2796 wrote to memory of 1680	2796	Unicorn-24833.exe	94
PID 4412 wrote to memory of 3312	4412	Unicorn-53513.exe	95
PID 4412 wrote to memory of 3312	4412	Unicorn-53513.exe	95
PID 4412 wrote to memory of 3312	4412	Unicorn-53513.exe	95
PID 3488 wrote to memory of 1204	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	96
PID 3488 wrote to memory of 1204	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	96
PID 3488 wrote to memory of 1204	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	96
PID 2080 wrote to memory of 3052	2080	Unicorn-54386.exe	97
PID 2080 wrote to memory of 3052	2080	Unicorn-54386.exe	97
PID 2080 wrote to memory of 3052	2080	Unicorn-54386.exe	97
PID 4608 wrote to memory of 4748	4608	Unicorn-36845.exe	98
PID 4608 wrote to memory of 4748	4608	Unicorn-36845.exe	98
PID 4608 wrote to memory of 4748	4608	Unicorn-36845.exe	98
PID 5016 wrote to memory of 2780	5016	Unicorn-4630.exe	99
PID 5016 wrote to memory of 2780	5016	Unicorn-4630.exe	99
PID 5016 wrote to memory of 2780	5016	Unicorn-4630.exe	99
PID 404 wrote to memory of 3204	404	Unicorn-32106.exe	100
PID 404 wrote to memory of 3204	404	Unicorn-32106.exe	100
PID 404 wrote to memory of 3204	404	Unicorn-32106.exe	100
PID 4400 wrote to memory of 5064	4400	Unicorn-40235.exe	101
PID 4400 wrote to memory of 5064	4400	Unicorn-40235.exe	101
PID 4400 wrote to memory of 5064	4400	Unicorn-40235.exe	101
PID 1680 wrote to memory of 4492	1680	Unicorn-48351.exe	102
PID 1680 wrote to memory of 4492	1680	Unicorn-48351.exe	102
PID 1680 wrote to memory of 4492	1680	Unicorn-48351.exe	102
PID 2796 wrote to memory of 2340	2796	Unicorn-24833.exe	103
PID 2796 wrote to memory of 2340	2796	Unicorn-24833.exe	103
PID 2796 wrote to memory of 2340	2796	Unicorn-24833.exe	103
PID 1204 wrote to memory of 872	1204	Unicorn-29612.exe	104
PID 1204 wrote to memory of 872	1204	Unicorn-29612.exe	104
PID 1204 wrote to memory of 872	1204	Unicorn-29612.exe	104
PID 3488 wrote to memory of 4256	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	105
PID 3488 wrote to memory of 4256	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	105
PID 3488 wrote to memory of 4256	3488	39cb8c3bbc52c9711a619dd9e58c9a80N.exe	105
PID 3052 wrote to memory of 1444	3052	Unicorn-10011.exe	106
PID 3052 wrote to memory of 1444	3052	Unicorn-10011.exe	106
PID 3052 wrote to memory of 1444	3052	Unicorn-10011.exe	106
PID 3312 wrote to memory of 1556	3312	Unicorn-21709.exe	107

C:\Users\Admin\AppData\Local\Temp\39cb8c3bbc52c9711a619dd9e58c9a80N.exe
"C:\Users\Admin\AppData\Local\Temp\39cb8c3bbc52c9711a619dd9e58c9a80N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23951.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        9⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        10⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13860 -s 464
        11⤵
        Program crash
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31600.exe
        9⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        9⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        9⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        9⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40815.exe
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        9⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        8⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13248 -s 464
        9⤵
        Program crash
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41609.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        8⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23753.exe
        8⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        8⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        7⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41033.exe
        8⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 464
        9⤵
        Program crash
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        8⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        8⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        7⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33597.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
        7⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        7⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        6⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20033.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        9⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        9⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53556.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        8⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32595.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
        7⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        7⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10857.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        8⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
        7⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        6⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16249.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        6⤵
        
        PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25796.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19649.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62207.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        7⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        6⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23531.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        6⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2764.exe
        5⤵
        
        PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
        7⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        9⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        8⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2217.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        7⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16311.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29099.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        7⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54847.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        7⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        6⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51382.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37665.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        6⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        7⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        6⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21878.exe
        5⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53821.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10768.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        6⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39623.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37733.exe
        6⤵
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18371.exe
        5⤵
        
        PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        8⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        7⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14365.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        7⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62221.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53198.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54772.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37707.exe
        6⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        5⤵
        
        PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30877.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40418.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe
    3⤵
    - Executes dropped EXE
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34231.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60977.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        9⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        9⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12308 -s 464
        10⤵
        Program crash
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        8⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        7⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8335.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59571.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        7⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
        7⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        6⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34034.exe
        7⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-873.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63469.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        6⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37360.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
        5⤵
        
        PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6488.exe
        6⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43109.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61061.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3379.exe
        5⤵
        
        PID:12908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19011.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46286.exe
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8709.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40744.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        5⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        6⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        5⤵
        
        PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        5⤵
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 464
        6⤵
        Program crash
        
        PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65425.exe
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
      4⤵
      PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
      4⤵
      PID:14652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47059.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        7⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48975.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        6⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42507.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41583.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        5⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        5⤵
        
        PID:15100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15100 -s 436
        6⤵
        Program crash
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
        6⤵
        
        PID:820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34888.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        5⤵
        
        PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      4⤵
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21201.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
      4⤵
      PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16593.exe
        5⤵
        
        PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
      4⤵
      PID:14680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
      4⤵
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        6⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12880.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        5⤵
        
        PID:4420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 476
        6⤵
        Program crash
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        5⤵
        
        PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42342.exe
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55545.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29995.exe
      4⤵
      PID:15244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
    3⤵
    - Executes dropped EXE
    PID:640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35840.exe
      4⤵
      PID:15296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
      4⤵
      PID:15796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25950.exe
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
    3⤵
    PID:12004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6305.exe
    3⤵
    PID:14752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14752 -s 476
      4⤵
      Program crash
      PID:14296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46919.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        9⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        9⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        9⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38371.exe
        8⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        9⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        9⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        8⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        8⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-167.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57905.exe
        9⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
        9⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29548.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
        8⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
        7⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34615.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        9⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        9⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
        8⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31188.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3080.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50608.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        6⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39305.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2034.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9145.exe
        7⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17131.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28653.exe
        7⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        6⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16785.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13176.exe
        7⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14784 -s 464
        8⤵
        Program crash
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        6⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57075.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        6⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        6⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42867.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        6⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52835.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        8⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39731.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3384.exe
        7⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52997.exe
        6⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62798.exe
        5⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39425.exe
        7⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        6⤵
        
        PID:15248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15248 -s 436
        7⤵
        Program crash
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        6⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38040.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        
        PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11179.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        6⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47631.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        5⤵
        
        PID:12524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12524 -s 452
        6⤵
        Program crash
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
      4⤵
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6976.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        6⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        5⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33238.exe
        5⤵
        
        PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36670.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6464.exe
      4⤵
      PID:13044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        6⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18025.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25285.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        7⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37080.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22149.exe
        5⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1242.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        7⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        6⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49955.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        6⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        5⤵
        
        PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        5⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        7⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        7⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45938.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
        5⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        6⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63897.exe
      4⤵
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        5⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20385.exe
        5⤵
        
        PID:15212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15212 -s 464
        6⤵
        Program crash
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58315.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3981.exe
      4⤵
      PID:12568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61859.exe
        5⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64895.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        7⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        6⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35683.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        5⤵
        
        PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2757.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        5⤵
        
        PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55127.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50431.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        5⤵
        
        PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23546.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45397.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
      4⤵
      PID:1404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30469.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24739.exe
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        5⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        5⤵
        
        PID:11676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63546.exe
        5⤵
        
        PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
      4⤵
      PID:12560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    3⤵
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        5⤵
        
        PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17479.exe
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35511.exe
    3⤵
    PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37589.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42689.exe
      4⤵
      PID:16292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
    3⤵
    PID:9344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3408.exe
    3⤵
    PID:13196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        7⤵
        
        PID:15124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15124 -s 436
        8⤵
        Program crash
        
        PID:14292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15124 -s 436
        8⤵
        Program crash
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4957.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46281.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37977.exe
        7⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32996.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38415.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25081.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        5⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15559.exe
        7⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50282.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38575.exe
        6⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        5⤵
        
        PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14988.exe
        5⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        7⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11344.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57858.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        6⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        5⤵
        
        PID:14948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14948 -s 412
        6⤵
        Program crash
        
        PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
      4⤵
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47578.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        6⤵
        
        PID:15180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15180 -s 476
        7⤵
        Program crash
        
        PID:216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15180 -s 476
        7⤵
        Program crash
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        5⤵
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        5⤵
        
        PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15368.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54936.exe
      4⤵
      PID:13032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        5⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53774.exe
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        6⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        6⤵
        
        PID:13424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13424 -s 452
        7⤵
        Program crash
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        5⤵
        
        PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
      4⤵
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40307.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        6⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        5⤵
        
        PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
      4⤵
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60261.exe
        5⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        5⤵
        
        PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
      4⤵
      PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35217.exe
      4⤵
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        5⤵
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61880.exe
        6⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        5⤵
        
        PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55528.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
      4⤵
      PID:14088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40775.exe
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        5⤵
        
        PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        5⤵
        
        PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
      4⤵
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
      4⤵
      PID:776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 472
        5⤵
        Program crash
        
        PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
    3⤵
    PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
      4⤵
      PID:12756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
    3⤵
    PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21046.exe
    3⤵
    PID:12544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53883.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23671.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42429.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21048.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33841.exe
        6⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
        5⤵
        
        PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50354.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
        5⤵
        
        PID:5248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 636
        6⤵
        Program crash
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
        5⤵
        
        PID:15136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        5⤵
        
        PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      4⤵
      PID:15388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        5⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29753.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44417.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32545.exe
        6⤵
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        5⤵
        
        PID:10268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10268 -s 436
        6⤵
        Program crash
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31215.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17749.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36582.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
      4⤵
      PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
      4⤵
      PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
    3⤵
    PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19753.exe
      4⤵
      PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        5⤵
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49550.exe
      4⤵
      PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
      4⤵
      PID:13088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43006.exe
    3⤵
    PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
      4⤵
      PID:14236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60485.exe
    3⤵
    PID:9336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
    3⤵
    PID:12928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        6⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        5⤵
        
        PID:14600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14600 -s 452
        6⤵
        Program crash
        
        PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40225.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        5⤵
        
        PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51636.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
      4⤵
      PID:12840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7567.exe
    3⤵
    PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3847.exe
        5⤵
        
        PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15952.exe
    3⤵
    PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
      4⤵
      PID:14328
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14328 -s 436
        5⤵
        Program crash
        
        PID:16344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
    3⤵
    PID:9368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
    3⤵
    PID:13016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28845.exe
        5⤵
        
        PID:12944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45963.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
      4⤵
      PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43747.exe
    3⤵
    PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
      4⤵
      PID:13812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
      4⤵
      PID:2160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
    3⤵
    PID:10824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18537.exe
    3⤵
    PID:14672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
  2⤵
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
      4⤵
      PID:13260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
    3⤵
    PID:12116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14547.exe
    3⤵
    PID:14712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45654.exe
  2⤵
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
    3⤵
    PID:14312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
    3⤵
    PID:5776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
  2⤵
  PID:5448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37493.exe
  2⤵
  PID:11356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27386.exe
  2⤵
  PID:15324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5248 -ip 5248
1⤵
PID:7824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 14328 -ip 14328
1⤵
PID:16316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 10268 -ip 10268
1⤵
PID:16360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 14784 -ip 14784
1⤵
PID:15580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 14564 -ip 14564
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 15100 -ip 15100
1⤵
PID:15916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 15212 -ip 15212
1⤵
PID:16224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 15248 -ip 15248
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 15144 -ip 15144
1⤵
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1676 -ip 1676
1⤵
PID:15528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 776 -ip 776
1⤵
PID:15904

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:6128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe

Filesize
184KB

MD5
086dbd2def304051f3ce0ab3e4d9e579

SHA1
08224a1d6b8e588c459c31345acab725ad04986d

SHA256
daa1fa65b8ff47568160809aa6f18470c811e300452a634051db82c98b139aba

SHA512
a9b1309574358bfe31c8228ca367dcd397229264adacb20b6375a276b3e96e967149f25ea8a1f635efdcbc235c6d477e3ca6461a738d0f12cbecb108f6a303b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe

Filesize
184KB

MD5
bfe407b39b43dc1b52bc3c16687c85fa

SHA1
811d4ebd1f8947bdc4b689d753f626472edf11bf

SHA256
d11e2ae4e7f55b46e43b7875bebd14b6c13c16b5b015a3643e1e42d312485a13

SHA512
1d1884e87e438cb9e61d5d94478baa3787e86b94894b8bb67660d62e8c6bcf0a420f1123549e6b245137d2d7b0d46a36a11cdc446fac579a40e5d06f68c294bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe

Filesize
184KB

MD5
64fe05454c4684007f1d41ef1b2e154d

SHA1
94cbe660ca262d691e052b0f8e745595bb24962d

SHA256
792f6c0400a03f6b49678a0e6a2705d9f4b69624b2fa887b242515301571da60

SHA512
9123d3781ae5d81d8278088e03eccb32d0a503806d0e9b1a7bf872dafe47c05f73fdebf788515b51326f942110a94327efb8620b73f00537dfb01118252cd9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe

Filesize
184KB

MD5
eeabddd138b39e76e60a6314091f51bb

SHA1
b65bf3effd625b2427f5ae50766039dd6eb5d95e

SHA256
23a763e9f3945d87b5d0b82a20623707c150b7b97d2fdf64292f73cc427eab56

SHA512
a9565928e78806ef9775cc3d096462f157b85799fe157da25d9b1089e432c0c8ffcfeffd123f67b2e7c8fde766de07e855c6652dea20dfecfcfda41bf2951748

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1605.exe

Filesize
184KB

MD5
d662792eb18f396ec620160645edde19

SHA1
e7574c7107e3ffc23b1ec972bdcf74a41f02abc7

SHA256
0cac469ad6ec527cd62b2f8fa5049e3af0104d4118f992797ff0a9aea5871940

SHA512
c346b5a4a9f3d897caf0a381c2bf2818fdff3b14cf6cf0a10da7ebc02ac8929538173f6f475182209906441fe453a4041e2e61115fd534fd24de67044d38777d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16385.exe

Filesize
184KB

MD5
aec2c98f3611e0cf24cbe92afcd17e9d

SHA1
fd39c51c13dc17a09156b6f1d4e7cb210b3b3f1f

SHA256
a6b7cbcf12df766163d21e0a77dad35fa30ff360ff76d4a82ed651ddc03e9500

SHA512
3d55d3d5260a0effcf2f8e7c832a0042b3ef9f39222eddd72ff529d709a22390b4086ed69c37ba7e8bb20e3f5472bafa313059167067237d61d0f08b185a89b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16939.exe

Filesize
184KB

MD5
16ecffc76b71d1aa37cc964f60b1774e

SHA1
c4126b52068e23617bb5df6023d5b49a698e8165

SHA256
3a37d301f77f9e551d216be70c12d71746f6b10c7bb987ffa869e8bedcb4accf

SHA512
a3a0e0544ec30c812b77faaa0f8542589e511e8bbb276f034f87325a9cf6ba3aa3da86ad4152cadd10e4726217c4314814f5dedbd90b41f8a5ba00f27ea34fd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19077.exe

Filesize
184KB

MD5
2d6d0f2fc10bf9482ed605f640be50b4

SHA1
a4805ad2696a14b31d159531c071be76fd35ce9a

SHA256
d902d1cea7f441599e8340ffaf06a1ecd7863d82e257cafba6ce26fb07a9ba6e

SHA512
be53c9d87222e4f7be5fc9a038a8d23b739424da1bcd0e2aa2a86528f857210be6b0b25a175328c549fe1be626572f72665cf0b56e756566875c17560a8f5f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21709.exe

Filesize
184KB

MD5
da33ab144818257429470bcb6ed21820

SHA1
d937dec1fde91dde2e70c630a4e5741403535090

SHA256
7a55249bd5b06361ef347725d33c71991c0842c971d7e6356fcc1641cd866b35

SHA512
3c8b578130ab0b0dcd4cbb8015916f9bc5e8b1dc959d2d0834fe3333e04a52aeafd2966a766e2b75208f8770f87f25a9ff6f17431dcafa590128ca08051f620d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22760.exe

Filesize
184KB

MD5
1041e3218a6369272526c2e35cd134ba

SHA1
b020eda88432f34cec2dd504b78cb1e97b035147

SHA256
a91a0c7eb6d4a02e1103e9faff841253f1312f63ac17254fbd2cbf67f758ae2a

SHA512
70f315cf3524b854db8f5e34e8cda510aadaec2dd34fa36d65eda936b005446ef33f6c7a3527fce39168b013e455da067a0f459e41a3f32562a3a89755a8e92a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24807.exe

Filesize
184KB

MD5
379f59d9a82b7a779ac72d11dc206b95

SHA1
844fe1b57e72c8106c6e1da62525d93eb21213a4

SHA256
b99c2dcc00702eecc5a1d7156b46af82063c83c8d4bcd3a24ded45823350b646

SHA512
32712eb538346a201a27bf3d7ae7bc032b6331ea5d78ca1ba3bf7d0baec38ccaef0d93b0b9d911206cc7e2c48e76f989c5d7985c833b8cb6c708634068ecb9e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe

Filesize
184KB

MD5
cc150e088a0d6e80aaeedbfa26cce780

SHA1
63fff4dbe9c536366beb6750525ce38fd28d0f8d

SHA256
a052225f73fd28a09b91be7b308b13204fde4601eb528e296e80eb42b80afadb

SHA512
50e88e70628f62fe5d00c4be3e70313b74b854a4901a0de8148b1671ce6272c5d9e75610f4d23eca04688232c50d2ddf7ec6601828db74abccc89cb32c1cf0c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe

Filesize
184KB

MD5
7ee0dc3bd1d1a72411ed3f4fcfbfd1a3

SHA1
17e2c31ab44e693843966e9762ab32fb6f5bf3fe

SHA256
8e3551ebf1d9bfe2c60fb6778dd5b8cdbbf76c4d9a846294454b914212eceb61

SHA512
fa79d00a8f99704c855ba4ec165d89086909dd96409b51db06dfd86f5ce8aad295ee14369a4db01d7de2078477b894ef027d9c742713046ffba86dc5decb3881

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe

Filesize
184KB

MD5
51642720b04d56d250ee5d27b8237c45

SHA1
24b91efd8cb1c0c026258201c086a61d461e25c8

SHA256
b7efa5531b064c19dcadcbf52e20eb87f013efda692916c39fdd9f7af063a58b

SHA512
8ac08c8d99128ac7c8a0904b7424e2bd8e68114c8ac0124b162ee800e69de8ee0c225c6b6738fe241f11977b6cb3c6618e8a85c805c5b4704cd07978e7c37a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe

Filesize
184KB

MD5
e092f56ad3c551ec51d277add89b9693

SHA1
547852767635243005f3cead2912cca09c00f764

SHA256
7daefc806bd717abe205fcc6d6d90d52f67efec213337f74af24cee5f66836e8

SHA512
28e42d40e111b0234b20f4e007f3861be5c9c6b0e691c4317e6e30a8fb4629e168506617a07b9222952da38fafd5e2108634b761d5260664c2ee67cf71489879

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe

Filesize
184KB

MD5
96567f53b24cdfbbeb68a3d2fe00c87e

SHA1
306a15f56019a2a42d8eafd2e26a742835967673

SHA256
ae0d0a2f31973ca9899a37e381a98da6bdbf8c8d001b46a54bfdc14eba240ac8

SHA512
12e3f62b675a116195e1552cd2d3d324707e1972577b3118bf0084a1ec5de9c4405903c80a5e7d55a0c1ae9b3fcf8b53eb8b14386d88c52547924287816dcf8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32106.exe

Filesize
184KB

MD5
ecd2c52ea8d7045999ebe72eb65af395

SHA1
14e310fe2d5c18c9c53fd10ef497cca0c0719f91

SHA256
0f9f661345d98c4960929359c5ea8a5b58aa67c925d682c84e64c17c8d2a14fa

SHA512
688159b45edfc9bf808f1d5aa58649ea7c33122e80b6227efb6f21ff9b0b5a3523910fdfcbbe00bb15d81070ffb778ad325b5ec1343c4714ffa9642cc2325691

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe

Filesize
184KB

MD5
9a73917b6ac0b9c392fc1d33383360de

SHA1
a085506258cdd5895e24b2f7423709a6ab0ac8a8

SHA256
b948cb7e19a20fad61106e1dc4d1a575fec793d95c4eff8d48ca236c20fe2b6e

SHA512
b90e53778f14965d31a2173890e9350953b9fefc20d10cec76eb1ffa71aa36dfcff2c297e7a360c55b36c35247f7977b9021620a2a0b628ef9d45ab32540ebbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe

Filesize
184KB

MD5
fae27dcb94ac21df0916417f95270ce3

SHA1
77675f1b52c5fcaf789cf45ddafbfea9157d931e

SHA256
c1f0c21215ed4c3b1a71be8ada8b1d1b095b083f89c37a5016a8deb14f801855

SHA512
b6af9807ea2679be78cfca5d0fef9828c2ca913837c70ee8a52da957fc1b29e2eab729e061185c93a9e4f549c36520773e235408a0ca5410b7d2724c8e2f94d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36845.exe

Filesize
184KB

MD5
4244e5e394b4a76718e03aaa4856ad67

SHA1
ade56579a48c70feb6a7e7d04b97303ab51ceec2

SHA256
a2a66e4178f7526892525d5b6881c61b05ed697dd1dca93e50fc3bd5ab12fd2a

SHA512
b9fe5ca356fd5dd772e929e33d4c64b9655a268b9950c514dd6ecfc44e4845cd0c8a1eb56b86f8f08d72282c74e9f1cff19bada078a8f7bccc891b0b301e2ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38589.exe

Filesize
184KB

MD5
498c70624b61a021934f34e7fb9bf7ce

SHA1
fbdbe307ca32b2eb83130eeb204428c380017e0a

SHA256
1ad148a61f47628872f72f7e3121ccc5379717759565702ca04fe8ad1648395e

SHA512
740a1733e7bb5ec1f067e286ee101acf3776c9439cf4759d6e4d20df32ce4462bfa98769c623c37b7cee543b85a6818c058e89d2dfd09366d8f641b109d3ff39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe

Filesize
184KB

MD5
05c5abfc9b55913433a204dff0a90be9

SHA1
59343b15a7117619b3a5d5339554cff3a43b9867

SHA256
a484c51f6124c006ce828000426b3380d49f133e692227b83fe8b02ff29d4374

SHA512
14b9bc84f9cefc191e42679eb8a41f45baf897cfcbd29ed99a4d52ef3f54c57fd4157428b906d8e75acb36dd1c34c582f2f6f795bed958fd70921aa13868bed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39777.exe

Filesize
184KB

MD5
8db7e4aca7c504c1e041cf97adcd25c1

SHA1
d949f167a19721c7e1e7ab77ff59e4fb3a6ea6e3

SHA256
76280cedecfab74cdfc5c41b6c099e7862db2f32a1f9eafb15824064090e7fe7

SHA512
15760fcc8b425af4f4a1885220aeb18cdd2c626ba46bccfa40d95b210d6635147a453d4d9ca050158bd0a82e6446c6ec41792125538e46349b93710e60bd5581

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40235.exe

Filesize
184KB

MD5
ff18a34addcbe19c5ae4f2c888781031

SHA1
c30b024bf0e4ec53f79d56d11a110f0ae639ee8c

SHA256
19f08d707de9e85097bc1a97a8b7ae8d2451c34e540f1f22417bf6618407e203

SHA512
765fe3ecb4c1d815eae6fb4bbee895b9ea0bd57f9bbf99edfb230722728bd716adb4d950639df84cdb996a9cece936bfab77e00f17a6066ffa9d492345161ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4630.exe

Filesize
184KB

MD5
e0ea871bf2704d25a783933d754ea4a2

SHA1
9225a94d439107c944077bbb9d546b9ade1e2df3

SHA256
e58cd38da439f31c71fc181a92112660f7bf4c9b13cdc04678cd8e0850a2dac8

SHA512
67094af7979db07b14cf2c64f38bc1e2919a5100d542646ff73d3a00bd5df6465c108f306898fc458b37e096bdb0ebaa76b1246db224680f2bb0be21b8e91be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47111.exe

Filesize
184KB

MD5
cfd5ec136fa52693d0f54aae98ce4c83

SHA1
35c9527cfc056402a127e5fc5aff9619bb99aea2

SHA256
6434523648faefe25f3618bf3f1d55d55719652de6d9e94341d493f7b66483a3

SHA512
ed29c9f0418bfa3b85951b9255b3be4204013e7ed65394fe4f54990d1d28fa1bb47020757282bbee038f8e78484dadf92a420ed493312aee767a8970ae0f2ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe

Filesize
184KB

MD5
db4928ff5c6ae591ba93415e3b6c5657

SHA1
6c139df5b8dbe7abf4594627df964fd241a89fd7

SHA256
19a84386e65731af016194e93c3f02b2f8e0ea0498b95beb4f1241cb0bb25ff0

SHA512
923635ef602d3886340778385423bd248a497788eb486c7683264b8a07f842294f4b868dd99cb85d15ae431562250edd46ffc1630f1d1d13dc1a869ad9a7a50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe

Filesize
184KB

MD5
4a6b6376416f67ff045b3d9a244ed6a9

SHA1
8f11b2caba3e2ac9866e99d23a1e35ea06e3502e

SHA256
984760d073490d0d1e1177024dd63c6b10f0905824b4fb0d39a74b2bde9e44d3

SHA512
f1a146e613b16da52af4b0c5aafc1cef280b2eac6f5a0801bc6032d8537673df72fa12b55e4eebfcdf331f2a010fad7b819311e99817ce81c1ae5a73c1543717

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe

Filesize
184KB

MD5
b34cef787a8c0ae45844d4e119418b02

SHA1
f322d76317435876b476f5f159d6338cb86b73ca

SHA256
89028e42819e0891a52ad18d2024d05af034d797f88f2e08d9e23d0578027b77

SHA512
037aa1a40c2d4cd345aafdb95095e7e18dc0509d6677b7a6f5b6d5142dce4b44cdc6c1dfc12ca351d158f662655a2ffee3869622ab68f646f6f7028d5a63c15b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe

Filesize
184KB

MD5
b82069823488503af5c772d76d4ad918

SHA1
bc587e16d97021a7b7eeb824cf2a7859de0300ed

SHA256
b23e03e3b6a6d1217766b816336a0916a9a2803bd704e17e8e347faca95cc69f

SHA512
a40352adcae8e063e208e5da4ce27898618652470a948c7b15a7b56d883c4f81fa0b760e53d87f9dd69f6ec12596f4193c27d9ad691d5c0bc50872f6ed85f73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe

Filesize
184KB

MD5
e206ea9804f0fe7c059d389439f5d2d1

SHA1
306965c134e3fa252a28c9c81216a4bbe8200c3b

SHA256
d0efac517b4e13847ec5ae64b4fe92e3f32ca450899b3a44e1b9ec60f740dea5

SHA512
93c9ff151a5d1a4a6ce7e94303c04b7fb3e06d2d44a6e3617013aacb55b9f556923b2969627e9f0f04126fe7a4ee968a8095d2ec4a8cb1f19d75d2f4eb4d04eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62694.exe

Filesize
184KB

MD5
21f4b7d4537604b33c165eb821f8d186

SHA1
5997a718019ebe6d1bcc38bcde8c4d390eb5b39a

SHA256
5d02ed6561e15b590f5a9c6fffb9fcee10d12b4ef038b94351088a345176a35f

SHA512
139f6e16d95db58a5336d7440b37c2577943266019568ae5e8bf40d4fa3fc4a9856f789e841d4d6c4f94fbb53944e040fa057bff077453095851b80dea4aab17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe

Filesize
184KB

MD5
27956d8eb1c21de034a3c8af16f1bf05

SHA1
30b9d10d2f8b0dabfad97764f40cb7c5b4d393c2

SHA256
f3bdea343e62dfec2c901d4fb6a945e71d0c71ef620dd39bcef8fb07197d6c87

SHA512
9ea4f07455f45ab846d23237992ae12eb9ede83ebc39e4532698910a0adaf7d85db7166637665942757ae641586ee1a82d0ce977ee7b22ee265e3d71150102b0

Download Submit
memory/348-473-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/404-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/464-471-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/548-445-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/640-378-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/760-443-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/852-330-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/860-3432-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/872-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/924-506-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1144-477-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1204-78-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1248-448-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1252-225-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1332-462-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1392-444-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1444-147-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1512-476-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1524-216-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1644-522-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1680-65-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1696-470-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1736-214-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1836-161-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1936-235-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1996-335-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2004-275-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2052-273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2056-210-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2076-512-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2080-19-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2096-514-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2112-162-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2268-263-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2276-442-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2280-356-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2324-207-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2340-131-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2356-357-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2524-472-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-215-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2760-344-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2780-96-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2796-30-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2812-528-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2836-377-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2840-331-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2844-375-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2876-3198-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2964-3238-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3024-511-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3052-79-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3204-105-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3244-316-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3312-66-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3320-256-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3404-358-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3468-376-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3488-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3532-441-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3560-288-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3616-178-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3628-513-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3680-287-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3772-469-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3908-246-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4172-518-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4196-468-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4256-140-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4272-1049-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4296-379-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4372-229-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4400-6-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4412-40-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4424-334-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4428-478-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4448-525-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4492-118-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4512-456-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4512-39-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4628-314-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4656-317-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4708-257-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4748-89-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4808-289-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4824-286-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4964-274-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4972-255-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5000-208-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5016-14-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5064-111-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5108-315-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5168-529-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5192-534-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5232-1050-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5288-1051-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5336-1052-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5380-1053-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5660-758-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6716-3273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/13424-3465-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14952-3027-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads