b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe
Size

184KB
MD5

95009eca487f90a5726b7bc1bb47e6f7
SHA1

df442767c928e6b569977d3a9c02ad27689cce07
SHA256

b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593
SHA512

badb2be2e3bf16037068ffb4e5c44a8ca809460050125c8fdc78dac63aa9e612ceac530fccd5136b3c3489ffa742d85aeddc8e8513548661d8d6c926f6000b53
SSDEEP

3072:ZPT65kon1jCCd/XZWrWE88szuunqnxiuF:ZPzoku/XI8VzuIqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2296	Unicorn-58678.exe
3540	Unicorn-59353.exe
5080	Unicorn-24220.exe
2848	Unicorn-58736.exe
4828	Unicorn-58736.exe
3240	Unicorn-4252.exe
4472	Unicorn-17987.exe
2232	Unicorn-30774.exe
5056	Unicorn-30774.exe
3348	Unicorn-59424.exe
3648	Unicorn-30800.exe
5040	Unicorn-61718.exe
2076	Unicorn-55588.exe
472	Unicorn-63591.exe
4700	Unicorn-54727.exe
2268	Unicorn-39263.exe
2432	Unicorn-59129.exe
4824	Unicorn-17744.exe
3528	Unicorn-63415.exe
1040	Unicorn-31641.exe
4104	Unicorn-61625.exe
5112	Unicorn-55495.exe
4712	Unicorn-48231.exe
3516	Unicorn-28630.exe
64	Unicorn-16208.exe
3884	Unicorn-27260.exe
4852	Unicorn-38196.exe
2908	Unicorn-16208.exe
4772	Unicorn-57430.exe
3040	Unicorn-57357.exe
2084	Unicorn-53600.exe
3972	Unicorn-45017.exe
1332	Unicorn-25343.exe
3440	Unicorn-12536.exe
1984	Unicorn-6598.exe
3292	Unicorn-28214.exe
1992	Unicorn-44249.exe
4680	Unicorn-35318.exe
3780	Unicorn-24383.exe
4536	Unicorn-29670.exe
1704	Unicorn-1784.exe
440	Unicorn-6070.exe
2128	Unicorn-25936.exe
2224	Unicorn-33526.exe
3816	Unicorn-6070.exe
3644	Unicorn-25936.exe
2660	Unicorn-50724.exe
4064	Unicorn-25671.exe
2932	Unicorn-54358.exe
2000	Unicorn-54550.exe
4532	Unicorn-22070.exe
4688	Unicorn-17471.exe
1328	Unicorn-17471.exe
4796	Unicorn-31398.exe
2472	Unicorn-39958.exe
1148	Unicorn-39007.exe
644	Unicorn-45936.exe
3964	Unicorn-17654.exe
3064	Unicorn-40574.exe
4528	Unicorn-59833.exe
4668	Unicorn-58105.exe
1180	Unicorn-23164.exe
4648	Unicorn-37488.exe
972	Unicorn-33046.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
7152	7224	WerFault.exe	290
9188	5504	WerFault.exe	179
7272	6308	WerFault.exe	229
17892	14888	WerFault.exe	719
17960	14876	WerFault.exe	684
5196	3116	WerFault.exe	726
5308	16432	WerFault.exe	898
4464	17872	WerFault.exe	905
7284	15032	WerFault.exe	692

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe
2296	Unicorn-58678.exe
3540	Unicorn-59353.exe
5080	Unicorn-24220.exe
4828	Unicorn-58736.exe
2848	Unicorn-58736.exe
3240	Unicorn-4252.exe
4472	Unicorn-17987.exe
2232	Unicorn-30774.exe
5056	Unicorn-30774.exe
3348	Unicorn-59424.exe
2076	Unicorn-55588.exe
3648	Unicorn-30800.exe
5040	Unicorn-61718.exe
472	Unicorn-63591.exe
4700	Unicorn-54727.exe
2268	Unicorn-39263.exe
2432	Unicorn-59129.exe
4824	Unicorn-17744.exe
3528	Unicorn-63415.exe
5112	Unicorn-55495.exe
4104	Unicorn-61625.exe
1040	Unicorn-31641.exe
4852	Unicorn-38196.exe
3516	Unicorn-28630.exe
64	Unicorn-16208.exe
2908	Unicorn-16208.exe
3884	Unicorn-27260.exe
4772	Unicorn-57430.exe
3040	Unicorn-57357.exe
2084	Unicorn-53600.exe
3972	Unicorn-45017.exe
1332	Unicorn-25343.exe
3440	Unicorn-12536.exe
1984	Unicorn-6598.exe
3292	Unicorn-28214.exe
1992	Unicorn-44249.exe
3780	Unicorn-24383.exe
4680	Unicorn-35318.exe
4536	Unicorn-29670.exe
1704	Unicorn-1784.exe
3816	Unicorn-6070.exe
440	Unicorn-6070.exe
2224	Unicorn-33526.exe
2660	Unicorn-50724.exe
3644	Unicorn-25936.exe
2128	Unicorn-25936.exe
4064	Unicorn-25671.exe
2000	Unicorn-54550.exe
1328	Unicorn-17471.exe
4532	Unicorn-22070.exe
4688	Unicorn-17471.exe
2932	Unicorn-54358.exe
4796	Unicorn-31398.exe
2472	Unicorn-39958.exe
1148	Unicorn-39007.exe
644	Unicorn-45936.exe
3964	Unicorn-17654.exe
3064	Unicorn-40574.exe
4528	Unicorn-59833.exe
1180	Unicorn-23164.exe
4668	Unicorn-58105.exe
4648	Unicorn-37488.exe
972	Unicorn-33046.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2296	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	94
PID 3108 wrote to memory of 2296	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	94
PID 3108 wrote to memory of 2296	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	94
PID 2296 wrote to memory of 3540	2296	Unicorn-58678.exe	97
PID 2296 wrote to memory of 3540	2296	Unicorn-58678.exe	97
PID 2296 wrote to memory of 3540	2296	Unicorn-58678.exe	97
PID 3108 wrote to memory of 5080	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	98
PID 3108 wrote to memory of 5080	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	98
PID 3108 wrote to memory of 5080	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	98
PID 3540 wrote to memory of 4828	3540	Unicorn-59353.exe	100
PID 3540 wrote to memory of 4828	3540	Unicorn-59353.exe	100
PID 3540 wrote to memory of 4828	3540	Unicorn-59353.exe	100
PID 5080 wrote to memory of 2848	5080	Unicorn-24220.exe	101
PID 5080 wrote to memory of 2848	5080	Unicorn-24220.exe	101
PID 5080 wrote to memory of 2848	5080	Unicorn-24220.exe	101
PID 2296 wrote to memory of 3240	2296	Unicorn-58678.exe	102
PID 2296 wrote to memory of 3240	2296	Unicorn-58678.exe	102
PID 2296 wrote to memory of 3240	2296	Unicorn-58678.exe	102
PID 3108 wrote to memory of 4472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	103
PID 3108 wrote to memory of 4472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	103
PID 3108 wrote to memory of 4472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	103
PID 2848 wrote to memory of 2232	2848	Unicorn-58736.exe	106
PID 2848 wrote to memory of 2232	2848	Unicorn-58736.exe	106
PID 2848 wrote to memory of 2232	2848	Unicorn-58736.exe	106
PID 4828 wrote to memory of 5056	4828	Unicorn-58736.exe	105
PID 4828 wrote to memory of 5056	4828	Unicorn-58736.exe	105
PID 4828 wrote to memory of 5056	4828	Unicorn-58736.exe	105
PID 5080 wrote to memory of 3348	5080	Unicorn-24220.exe	107
PID 5080 wrote to memory of 3348	5080	Unicorn-24220.exe	107
PID 5080 wrote to memory of 3348	5080	Unicorn-24220.exe	107
PID 3240 wrote to memory of 3648	3240	Unicorn-4252.exe	108
PID 3240 wrote to memory of 3648	3240	Unicorn-4252.exe	108
PID 3240 wrote to memory of 3648	3240	Unicorn-4252.exe	108
PID 4472 wrote to memory of 5040	4472	Unicorn-17987.exe	110
PID 4472 wrote to memory of 5040	4472	Unicorn-17987.exe	110
PID 4472 wrote to memory of 5040	4472	Unicorn-17987.exe	110
PID 2296 wrote to memory of 2076	2296	Unicorn-58678.exe	109
PID 2296 wrote to memory of 2076	2296	Unicorn-58678.exe	109
PID 2296 wrote to memory of 2076	2296	Unicorn-58678.exe	109
PID 3108 wrote to memory of 472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	111
PID 3108 wrote to memory of 472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	111
PID 3108 wrote to memory of 472	3108	b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe	111
PID 3540 wrote to memory of 4700	3540	Unicorn-59353.exe	113
PID 3540 wrote to memory of 4700	3540	Unicorn-59353.exe	113
PID 3540 wrote to memory of 4700	3540	Unicorn-59353.exe	113
PID 4828 wrote to memory of 2268	4828	Unicorn-58736.exe	114
PID 4828 wrote to memory of 2268	4828	Unicorn-58736.exe	114
PID 4828 wrote to memory of 2268	4828	Unicorn-58736.exe	114
PID 5056 wrote to memory of 2432	5056	Unicorn-30774.exe	115
PID 5056 wrote to memory of 2432	5056	Unicorn-30774.exe	115
PID 5056 wrote to memory of 2432	5056	Unicorn-30774.exe	115
PID 3348 wrote to memory of 4824	3348	Unicorn-59424.exe	117
PID 3348 wrote to memory of 4824	3348	Unicorn-59424.exe	117
PID 3348 wrote to memory of 4824	3348	Unicorn-59424.exe	117
PID 2848 wrote to memory of 3528	2848	Unicorn-58736.exe	116
PID 2848 wrote to memory of 3528	2848	Unicorn-58736.exe	116
PID 2848 wrote to memory of 3528	2848	Unicorn-58736.exe	116
PID 2076 wrote to memory of 1040	2076	Unicorn-55588.exe	118
PID 2076 wrote to memory of 1040	2076	Unicorn-55588.exe	118
PID 2076 wrote to memory of 1040	2076	Unicorn-55588.exe	118
PID 5080 wrote to memory of 5112	5080	Unicorn-24220.exe	119
PID 5080 wrote to memory of 5112	5080	Unicorn-24220.exe	119
PID 5080 wrote to memory of 5112	5080	Unicorn-24220.exe	119
PID 3648 wrote to memory of 4104	3648	Unicorn-30800.exe	120

C:\Users\Admin\AppData\Local\Temp\b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe
"C:\Users\Admin\AppData\Local\Temp\b5127f43df90aafb1fe9855288a9f51b31c5d349e5ca7fdbca9e1bd872380593.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        10⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22454.exe
        11⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        11⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        10⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        10⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        9⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        10⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
        10⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        10⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        9⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52626.exe
        9⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        9⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3168.exe
        9⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11157.exe
        9⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        10⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22436.exe
        9⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        9⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10049.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65323.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23164.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        9⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
        9⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        9⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        9⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        8⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
        9⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        9⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
        9⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        8⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2532.exe
        8⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
        8⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13571.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        8⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        9⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64986.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        8⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        7⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        7⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25343.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33046.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
        9⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        10⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45570.exe
        10⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 464
        11⤵
        Program crash
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        9⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        9⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51584.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55510.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        9⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2728.exe
        9⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        9⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10212.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        9⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        9⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59577.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27538.exe
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        7⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62302.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        9⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        9⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19473.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32217.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        8⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12524.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25480.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        7⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54208.exe
        6⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14553.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        9⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        9⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        9⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        8⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60530.exe
        8⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        8⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        8⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        7⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        7⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        9⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36274.exe
        9⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
        8⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43153.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48700.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
        6⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        8⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7224 -s 212
        9⤵
        Program crash
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19964.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        8⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21720.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        8⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23390.exe
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        6⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        6⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12213.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24520.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        6⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        7⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46047.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15528.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        6⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31062.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        6⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
        7⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        6⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27196.exe
        5⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        5⤵
        
        PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41462.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        9⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1793.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3365.exe
        9⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1116.exe
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        8⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        8⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
        7⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        8⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15032 -s 464
        9⤵
        Program crash
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29493.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        7⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        7⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29977.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        7⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43260.exe
        6⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20603.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13763.exe
        5⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15897.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        7⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        6⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46225.exe
        5⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22250.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1197.exe
        5⤵
        
        PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34419.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        6⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40796.exe
        6⤵
        
        PID:17848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        7⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        5⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64923.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        5⤵
        
        PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12284.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28190.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
      4⤵
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      4⤵
      PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        5⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46056.exe
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
      4⤵
      PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24044.exe
      4⤵
      PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        8⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        9⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52859.exe
        10⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        10⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        9⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62265.exe
        9⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64607.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        8⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24358.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
        7⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        7⤵
        
        PID:18128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60928.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1560.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        9⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
        8⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        7⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37336.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        6⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        6⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65334.exe
        6⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 632
        7⤵
        Program crash
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20864.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9731.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        7⤵
        
        PID:16432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16432 -s 72
        8⤵
        Program crash
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1116.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24024.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58482.exe
        6⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10255.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44606.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        6⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31475.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37348.exe
        5⤵
        
        PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:17504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50173.exe
        6⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
        6⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        7⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        6⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        6⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        6⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40720.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57724.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6433.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31033.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55134.exe
        8⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        7⤵
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9170.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52486.exe
        6⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36124.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        6⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44408.exe
        7⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        6⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
        6⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13455.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16408.exe
        6⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36793.exe
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        6⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        6⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44806.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      4⤵
      PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        5⤵
        
        PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24554.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40589.exe
      4⤵
      PID:3284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
        5⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        8⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        7⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12097.exe
        7⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exe
        7⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39058.exe
        6⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        5⤵
        
        PID:6308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 616
        6⤵
        Program crash
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65236.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12795.exe
        5⤵
        
        PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26401.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49500.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20769.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59230.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        6⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55273.exe
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        5⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
      4⤵
      PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
      4⤵
      PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
    3⤵
    - Executes dropped EXE
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9599.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
        6⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        5⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        6⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56018.exe
        5⤵
        
        PID:17976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        5⤵
        
        PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59645.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      4⤵
      PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35690.exe
      4⤵
      PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6812.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47286.exe
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65279.exe
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21930.exe
        6⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2812.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        5⤵
        
        PID:17608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48314.exe
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
      4⤵
      PID:13852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2120.exe
    3⤵
    PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
      4⤵
      PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
      4⤵
      PID:8316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
    3⤵
    PID:9488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19868.exe
    3⤵
    PID:13712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
    3⤵
    PID:11240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        9⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13697.exe
        9⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52404.exe
        9⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        8⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13140.exe
        8⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21393.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28476.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44802.exe
        8⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        8⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33443.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56679.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        7⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3614.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38015.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
        7⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        7⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16580.exe
        7⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        6⤵
        
        PID:18016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65119.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6256.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        6⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        5⤵
        
        PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        9⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        9⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        7⤵
        
        PID:18244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
        6⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        7⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18048.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41087.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30369.exe
        6⤵
        
        PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60953.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52662.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        8⤵
        
        PID:14888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14888 -s 464
        9⤵
        Program crash
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54725.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        7⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        6⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        7⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38211.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3622.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5941.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        8⤵
        
        PID:17992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        6⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16980.exe
        6⤵
        
        PID:18196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14472.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        6⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        7⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29128.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4058.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10712.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
        5⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        5⤵
        
        PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45014.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        5⤵
        
        PID:14152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14364.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
      4⤵
      PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      4⤵
      PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51779.exe
      4⤵
      PID:4392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16828.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60510.exe
        9⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52114.exe
        8⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        7⤵
        
        PID:18004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36611.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36405.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50406.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60665.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        7⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47677.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7843.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        6⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26473.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        5⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        6⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        5⤵
        
        PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5173.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31347.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        8⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        8⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        7⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7704.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32796.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48585.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2334.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23609.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        7⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        6⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        5⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60018.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3698.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41398.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        7⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        6⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        5⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        6⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        5⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64219.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        5⤵
        
        PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
      4⤵
      PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
      4⤵
      PID:13724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
      4⤵
      PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52106.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55495.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29023.exe
      4⤵
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
        7⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21820.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        6⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        6⤵
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50848.exe
        5⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        6⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
      4⤵
      PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        5⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12803.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58390.exe
      4⤵
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
      4⤵
      PID:17456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35556.exe
        5⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26236.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        5⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22612.exe
        5⤵
        
        PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34854.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
      4⤵
      PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
      4⤵
      PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19341.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        5⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35503.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
      4⤵
      PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
      4⤵
      PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51570.exe
      4⤵
      PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
    3⤵
    PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
      4⤵
      PID:8788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48642.exe
      4⤵
      PID:15496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36723.exe
    3⤵
    PID:14924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
    3⤵
    PID:17964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44758.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        8⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        7⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        7⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        6⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18273.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59714.exe
        6⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        6⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12321.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        7⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        6⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21467.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
        6⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        6⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47435.exe
        5⤵
        
        PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5272.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41752.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46757.exe
        7⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        5⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8629.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7785.exe
      4⤵
      PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45058.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20329.exe
        5⤵
        
        PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11422.exe
      4⤵
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8493.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27504.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        6⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34994.exe
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
        6⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64484.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
        5⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        5⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36414.exe
        5⤵
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54592.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11115.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56736.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        5⤵
        
        PID:14876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14876 -s 444
        6⤵
        Program crash
        
        PID:17960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21001.exe
        5⤵
        
        PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24483.exe
      4⤵
      PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        5⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
      4⤵
      PID:18428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31398.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16082.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12384.exe
        5⤵
        
        PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        5⤵
        
        PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        5⤵
        
        PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
      4⤵
      PID:1912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8079.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        5⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28201.exe
        5⤵
        
        PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      4⤵
      PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
      4⤵
      PID:7888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29689.exe
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26275.exe
    3⤵
    PID:11188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
    3⤵
    PID:15836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18107.exe
        8⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        8⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2357.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-852.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42657.exe
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14476.exe
        6⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12728.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6994.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7776.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
      4⤵
      PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      4⤵
      PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17471.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4569.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1117.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8446.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        5⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44283.exe
        6⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24712.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        5⤵
        
        PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
      4⤵
      PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        5⤵
        
        PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
      4⤵
      PID:12284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36219.exe
      4⤵
      PID:16412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
      4⤵
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58351.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
      4⤵
      PID:10688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
    3⤵
    PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
      4⤵
      PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9338.exe
      4⤵
      PID:10428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32054.exe
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
    3⤵
    PID:14536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42923.exe
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38192.exe
    3⤵
    PID:15560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29974.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        6⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36027.exe
        7⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
        7⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12452.exe
        6⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60854.exe
        5⤵
        
        PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31427.exe
      4⤵
      PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        5⤵
        
        PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
      4⤵
      PID:16300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        5⤵
        
        PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
      4⤵
      PID:15428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
    3⤵
    PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
      4⤵
      PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
      4⤵
      PID:17872
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17872 -s 276
        5⤵
        Program crash
        
        PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
      4⤵
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
    3⤵
    PID:10952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
    3⤵
    PID:15444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
    3⤵
    PID:8612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
    3⤵
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59606.exe
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63234.exe
        5⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        5⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60524.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      4⤵
      PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36892.exe
    3⤵
    PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5143.exe
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
      4⤵
      PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
      4⤵
      PID:1424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12905.exe
    3⤵
    PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24260.exe
    3⤵
    PID:18000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19103.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19103.exe
  2⤵
  PID:5984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
    3⤵
    PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26649.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
      4⤵
      PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46258.exe
      4⤵
      PID:15384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
    3⤵
    PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53416.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
      4⤵
      PID:8320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
    3⤵
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    3⤵
    PID:14664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
  2⤵
  PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
    3⤵
    PID:11556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
    3⤵
    PID:17652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
    3⤵
    PID:17836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5719.exe
  2⤵
  PID:10252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
  2⤵
  PID:15316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
  2⤵
  PID:9528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7224 -ip 7224
1⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6308 -ip 6308
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5504 -ip 5504
1⤵
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3116 -ip 3116
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:9420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe

Filesize
184KB

MD5
79f49b161518c68207955137281d3e17

SHA1
84542430f5b7b676b336998fa994bf01d4bcd59a

SHA256
d38f44ae7bd6f09770459754138fce7b05d1266acad2670efa0bee815f4769cb

SHA512
57f7fe00b161cc7750263b4ddbfc9d9f570f046f4dc9d8a4d817a0c9e4185e04c3fdfe35912742ec3f5e756f62a5a36c6bc682ba7994a675878410488d0c37d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe

Filesize
184KB

MD5
d714f0e01a65089d679f533b42843401

SHA1
696aa5f077908dafe4c9bcd68f969779e7beb698

SHA256
d06f352b13ae350632289e9e8db16e2be3ff916a15c30cfe84d5d12074074a92

SHA512
737e65c9f858e0bbbd7c29d3eb7c68e3fddfa9087cc52af7e7f38db85be4eeed8e34d37c874917972e898c9afed7cf9f2174703b5c5b433c2f398623c5949b1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17987.exe

Filesize
184KB

MD5
fc8d6d3fdc2888093cb692a15bc912f7

SHA1
732ae2eb2fa8c94c2683ae35912073ada9ff2589

SHA256
7422ef746243462158c917cf1b00f25a7d755858caf28febb9b54a23311bbc38

SHA512
739a274ec3f967e3303f8417ddef8350ae902c721b3e2952be11173f2ccf3fa1b4fc5498bd060eaa80386e372bfa410c9502c120bd076bf260d22093ebc4c169

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe

Filesize
184KB

MD5
c5bc58c3811820e8b9b33acbfaedf52a

SHA1
4e56aeb227f739d5906d336964a9748abde39b64

SHA256
8aecd3e80b6fb8ac2061b9efbf745232aa55a361911b1560c72d9a73c9a51bb4

SHA512
d20c8a62725a1d662ebc0c0d3ccea7623fe781b8a1a71f8aba59f85a42fa600043258a8749d5516ff761deae6a6fe318806e2dc78df8c78d5d8773a77c892bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe

Filesize
184KB

MD5
2d839a9369eca16f145c07619c3f280f

SHA1
0acd6746b7b0ae045a34a96fca664b7d4ead5144

SHA256
844353520b4d125ae0c18f2c20aa67027ce7986f8a814232282f53790ec40e48

SHA512
0413023540e3aa1bee371f3d6fbd249949fd9b49e9f4b8fc82b219cfa14b555ffc0af3bb34c0b52e0fea0ed216d17d2e57b26d63b9bbf3176c919ea2285ab8ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27502.exe

Filesize
184KB

MD5
6f8c6d0ddac73c00361636c15501149c

SHA1
b81fcfffe0ca53abc359034171b646b1027607bd

SHA256
cce5a0946d8b522c05600668935094a2407305a89d79a22e95c89d242c06879d

SHA512
939e87b5f7a50812d893d22746f8e41c2f93fa0ea68aaa3b6b7b26f93f98a6b006f35b16c615a6a6dba0ee825f61f35e5cc6db1d612c62a4173f15380f0ee3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28630.exe

Filesize
184KB

MD5
b781a639b75da52ca6da31955883c9bf

SHA1
8b1376b8b7356d69e59da5df6e8ba961f48e4970

SHA256
91960661c696f87f7c5bcb1d5eb03a158a1949b2718a60352e90cc3893acae2f

SHA512
a75ac28aba580c58626a78b8222f18add6d53edea40097a8fc9d3f15ab5ac31e76be1d5592408ad8b9dcaae99a855e5e874497abdc0efaac8f3f5e50fcce421b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe

Filesize
184KB

MD5
70096fd43032500cdfcaeb797812b9de

SHA1
202caa7d99046cc10b2c78b9ab281b2327a80e86

SHA256
f464564c0c57fad23f476dcab65c4d3e4b318fad1b1ddcab00e7cd32b9a5315c

SHA512
13fce6215c65ec98c1b5c3020dfeb65765c67741a566df2cb5b2c324d3f4510e6610bf8ffcdf783a988caa9be3bd9129f575e5a13ae10f7de176b1c75ef7a042

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30800.exe

Filesize
184KB

MD5
263d8f0c22e585a51da6fca6b64e260d

SHA1
ccf15cfbfda5be76b0200958175b6ffc5b53fdb3

SHA256
80dbb8db02f707154ad01c888fb98fe7ba7021101218eaaa53d262664df1c074

SHA512
7f9a20b5599943523b909aa777f7af380045c3ce3e1ce4a501c436d9012b02c967e218e23ae97781ea8221fc81790a305f547b9f777dcf84e96ea5db10ca5412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

Filesize
184KB

MD5
5645a928cc1adcf32cffb703869fde7e

SHA1
2fd88243200a7282e7db402a5424d9a8863e497f

SHA256
6a583c75f70ccb9dbec88369c9b6bdb173de5283302c9256ac2ff0a77226f9a6

SHA512
c39b7d603e7f9b45621b98121c8c9313772de219bb8ae873fd7c41dbce573305eee4b3b4abb0e6448193896f2b6406b0a9d3fac4bbcaeb2c1f8d3932fef128ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32406.exe

Filesize
184KB

MD5
b8e55b7f18ad531493bb832063a246fa

SHA1
ce71f637e1012b8c8b836fe0871472770f765684

SHA256
a385a44abc5a68f55bd80aa880764ce96c8fae112204d5dd5f306f67d0a81cb6

SHA512
b7504a1dea51c9e57e39853a64625e9e0ab55d74018870e55160144797b661e057df5b53282448523ee8d460b8619851aa37e8fcae607bb9c41e74243319581c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe

Filesize
184KB

MD5
1915eb69def314fde4eeddcc9a74fe40

SHA1
f8759621d7e134923871701d32579fb7f99222a4

SHA256
82f9c3083df389db9143d562f49a0447d17bcc1a0337411e4c698e52dbd18726

SHA512
01c60c53d1b10b254cd9361adba294076b467445998e44a74b9e33d8a79e4d672914a8f9a47c77931a656d56cf2e3185b65fbca2917e61a2951a4eb4be019957

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe

Filesize
184KB

MD5
ea84d5c6b4fa2b36c9aa922bf4654552

SHA1
c106bcf6cc4847dda12b837950947e937e005780

SHA256
48d1c946c8e0886593f8e63f8c288ce84e4ee39bbf40dbd298415234b7bc9a88

SHA512
c43f0cd52b99e4109070155d6656bb66f6e935fe13bc2340b7b87fa00c38b311bf293bf193cf7b6c29d56ba5c48d5b82969a9b2e83f971a3c897e88c0de7c041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe

Filesize
184KB

MD5
6cbf19bee605f40dd2115209ecc93d06

SHA1
07b4eaef7336214ac785dd417a25c9d8052b3546

SHA256
5993c73b2a92e1f30d2513feceacb6d84003555ce8ff533188b576f5d0939e9e

SHA512
a13fd3c8daecc65806d049861f84945840055d7c3dbcae57f75f7a5ca67da03c02d886c11ddee9754c67e51bab1b673789787459f54c39b87cff340fabc90a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4252.exe

Filesize
184KB

MD5
9f2696b86575b318c9ba9a718231efde

SHA1
7d6078e5db518f9b9ee5a6ec9d545a283e5bc9e5

SHA256
ea714135049fca8a294a92a5020c28f068961dfc2b0e1ca491c2c373c01999ce

SHA512
7eeb99d16e712b9ec325ecb90ac97e031c29d13cd08f7e403d8804a6531b6cb6a5e01ad4b9e923715522e7496dbb465b977f481423ede3b8ca30aa1f02e795ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45017.exe

Filesize
184KB

MD5
9c3fde5af9e812cbc625bbfe2471551b

SHA1
2683502d4ecab34f83dd405a4551333efd2fe1c0

SHA256
f38bd5b46915291f4f7724597c085ea20ae32d244284cc301b5acf10a473c864

SHA512
cf0d786d66d4261002aacacb8c78208e78d899c460097c47850e6070fe86666fefcc695fa0b4ae5cb1f9bef4fff0b0fa5a52f087d88238e6bf371e5ab1de6018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe

Filesize
184KB

MD5
315e49536b92a39694bb4de6a05dbb99

SHA1
28f6e0d701c816698774fd6cd347d1339fa837fb

SHA256
b9a912362d6afe64a7ed87eab774bb693261e16bd0ad0b95aeccd8a7609eaecd

SHA512
4ca738fab4fd1bd1a98be7e33672131a0f7b627ec59a81ac791a9721ef74f98ea82416ed604635665f1c9d189b9ec179085f805d5c9fcc3e6df14fdf54af0fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe

Filesize
184KB

MD5
45eb80b9f6d85b304b0c241b5175a9d8

SHA1
7865ec41db126f557d004043e140491663a73fdb

SHA256
70e2c43db71b81017bb124cbb2a5f615c59cc02bf8756224c2d66e4d05553c9a

SHA512
a83b2d6d275483002aab3efa3638ab6d6d480b3ec9310bd88b0be7a60f9592704d1096d8e134c30ff3c5a9b43b6c5394650994cb1ae9d9d8d46dc09581a044b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54727.exe

Filesize
184KB

MD5
5d3d2c1684f53ff571c9175f103e861c

SHA1
4370ba64af4ee5320e56dbe07db65ab83ac49db4

SHA256
50971cfc63bff0201aaedfc19d139c4c8bb2b5f94cf69c910ff1115b7a9bc771

SHA512
edeb4fe196bfb2c75cd7a8b3b90f438e32bfe0fd7ecabf9bed4d9ee70773bbede3909f449ba5c855f395013e6e9ba1fae1f24ed409c49ea61d5972b0563dd7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55495.exe

Filesize
184KB

MD5
ce8e0c6c49104c5ca5701ab2671be8d8

SHA1
0526be29ce05ead480964acb0d616a2fee35fc24

SHA256
74e9f573d1db2a360dadcf9ae18b039afec79fbc36024e21f66a84b57fbad06d

SHA512
12197e1d3c98c55247d74647d08a19996a91d6fb35150ffef6ba63ced6867ffd958a7dbead35e6cf856a6d4ddceda98abdc52dd5f95e6549ba8058e9f0dcb75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe

Filesize
184KB

MD5
281906bf98991b1798fafd44176fb02a

SHA1
159d28f8d7ad16de75cb7044844192761afed2b1

SHA256
810bfc63767be7378a9d6b43971810f7d8a0fed183f730903c7bec97f3d3e3ad

SHA512
3adeb3a8f9f01497014cd7fc01ea3e15bfe1a7229fe163990210f34592a2c2e87604b0799f00f9eacfda47d935cee32d8684d79c623c94b3de14c2813217bc42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe

Filesize
184KB

MD5
bc19b40707acfda48952ba431a27ec02

SHA1
ad54ede5fce9549e952b8578d7d6bfcc46f4c465

SHA256
767f3563115d7246679b709c83c4337b3fc4063b63050e7167779d3cf920c935

SHA512
0bd56df2619d18e50d86f47834f64e191a4e125e0386c9d0d2117b58bcc073139c53d3109fc622a07b9696ff63e7bea656a62b82f6cf8962c45aac795f6c4863

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe

Filesize
184KB

MD5
f6b68da08a63368e31269f77141d48b3

SHA1
2da2c9316ec0aca25de6b5d0385cfcbc091284a7

SHA256
540446a8f10dfed7bc25015a06a055cbdf57e7de4094acafc190c7da7aeed2a1

SHA512
5659ba6d027e5a9f4f0b52570118b46c1e8b29f1e135861ec448a7961370b73b7f6be8bafda4e37ba4313a604d641b7c5a3324977f153e31c3325a06d1b3efc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe

Filesize
184KB

MD5
9f77671ecab944b58b40cc66bfd6c61d

SHA1
f16ba6a36c729a2bd8330282ca12a17e0a0c95e3

SHA256
047d6bf9891a5cbb9006b0cd4683feb5a2ec959bc7f1cd0c4cda840361de9e2f

SHA512
45b4eb8ae7747a54aad8ac9bddfe12a541f83a560e8c7363cb67dc8390000e2cec586c166d172c95e04b3c6eeadba169576a63e29edf4ec0363eee4e9a00a1a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe

Filesize
184KB

MD5
bf7f1755e85cc9c1cdaa1b14f95cffed

SHA1
06ef79e11d9e603c2cd58b4a01d95bb1e2c63b31

SHA256
b3e4dd2b65171365c1a2bccad161b4795b4eff93b57d84386b0afc7afa72ebbe

SHA512
059f3d055c37929f04abaee825047a2deb88c4ceabc2c4b0c98c62024e984d2207928cab074724023e274d90b6e300a4ed8c4b9e5b552af73ef4ac58c8498bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe

Filesize
184KB

MD5
4d121c17ad66245f99fd38b4696898e9

SHA1
d7d1d2e43980b3c16bc2ec6c04d9c02b8c7b2344

SHA256
e60e364ee6b781e3ab7a74015321771892ff3b7a324647bee16ee09afb81e732

SHA512
61b6b4ee1ac52744e01ed1885ac77d228d73614b61ebb99f9c5193e474cb06c374a6a31d8ba5bd2e419ff5936ada6378b515d85ac5ad2d5e3d6725e1e403d75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe

Filesize
184KB

MD5
c26703968513d2927fe27dde9710a3bb

SHA1
c5ab89ef7197acf899011996d49f728fa1747b03

SHA256
7d3bd199a3a3c972cd1f028c70940c695c0755411f52ecc376bf82211306ece7

SHA512
4c03640f8a596d1f4163abc62c0a8c4093049bcf17042d26ced7cc5a560659588ed22c9ff98a96c53cf946f8c4fb17c291ef0094c851e5e191fe7d3af5c631d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59424.exe

Filesize
184KB

MD5
aba0a9c34e88cc1e836b1c1b2089793b

SHA1
92b2de4122b4d0503b59071c5a1eecde3dae52d6

SHA256
80f13593097442b58ebaf5879e3dfbf4cc4adc381dfa079cea5d3d3b7588bacc

SHA512
eaad7018b6b2a4901f50098a6803befedc83f9cf64d8915c216037c2f959debabee688723f888b799e0e348af9f8e357968d315edb66872a83c93af08d600c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe

Filesize
184KB

MD5
2d0499566199cbfc225eef47ef0ca5c0

SHA1
9ba27e7401b754427b85ae26e1a4ac043cadc144

SHA256
8b1f2a23fef0ba4eb5c70c49c4bef3e5007be77f2d572401e075704af3ae18a0

SHA512
370da05965af6428d578fca18c70b0f28a1a83a9150ccdaf74e17e7937fe78ccc1b48f14c92e9de32becab9f2f894460b65e8b7122097b7e1640cb2d070d0e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe

Filesize
184KB

MD5
6ec78c4d9a0b242a1bd0cd062ae205ad

SHA1
6d01925502d987877fef01173ca44af38a361cd9

SHA256
fe2edb2888a7918ad4f144d7600bddf854586aec652185b03c58339731b38f8f

SHA512
7854457af02ef065e7ab0fd40b07bbb9128e97cfae0aa57f7cb79ed3a08e05625025748f8c248cbfa17d3c3695f4888efa676b21753033bf22ad05d0d7473b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe

Filesize
184KB

MD5
b8d0030279e48cb50710b8b8cceb03f6

SHA1
13ff6f34e8a5bdbc88ef9ff1c70d2dff33b39711

SHA256
1ab081dd049b139b4a85a36cad888a602faae5a1f4ad6737a04296c3c0cc21e7

SHA512
7dfd8f4ed96077929885118b79d2121d30362221061a114f871c15880b336b2702725e9255258b4fc1ea48bd6e3a55a6a926f68e663a3ad068c64213014974f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe

Filesize
184KB

MD5
dafcdd89fc1f3fc1e203a81c7f1e4817

SHA1
3fd7d4f7a365bf6d0266148eb892b48cd30fb5df

SHA256
1c4ca59274c60c2d4c51747ea7940c4570f4dfa3b78202a18841adf7b09ce447

SHA512
4b74b9ff70059402c7693e1870cba99f2a3c69f03386f844c5796c44815fafc0a182e8c506c5d01557686ac9594e8c57a700d0ea433f784d98da38bfc42e9605

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads