c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a

Analysis

max time kernel
39s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe
Size

184KB
MD5

37071d8e5405abae3573abe6c550ca16
SHA1

4ef574a5d9e8c82c0b84666e08a5966c0dccfd78
SHA256

c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a
SHA512

832e25ae5db3433c03d9a6ca49b233ac5303715783100e4ac4ecbf8fd400160b4a2a91a2d09d560c1eccab4e9ba8a7151efce904d82dcd0c690886ccddc92ecf
SSDEEP

3072:ZaIqMoonyIuSZRKtsNnh8sup3lv4qnxiuq:ZaBoE6RKa8rp3lwqnxiu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1212	Unicorn-17277.exe
1292	Unicorn-44879.exe
3524	Unicorn-6539.exe
1064	Unicorn-1454.exe
3980	Unicorn-44525.exe
3296	Unicorn-36265.exe
3800	Unicorn-34873.exe
880	Unicorn-60551.exe
1152	Unicorn-54884.exe
1720	Unicorn-25549.exe
3140	Unicorn-35663.exe
1436	Unicorn-16923.exe
2024	Unicorn-34271.exe
3320	Unicorn-56851.exe
2108	Unicorn-30108.exe
3692	Unicorn-36815.exe
1344	Unicorn-43591.exe
376	Unicorn-8802.exe
4592	Unicorn-4618.exe
3148	Unicorn-23577.exe
4308	Unicorn-4910.exe
3460	Unicorn-8994.exe
2152	Unicorn-3519.exe
3700	Unicorn-53349.exe
1232	Unicorn-62279.exe
1728	Unicorn-15771.exe
4856	Unicorn-10675.exe
3500	Unicorn-29506.exe
4416	Unicorn-13633.exe
1640	Unicorn-19109.exe
1716	Unicorn-36597.exe
1448	Unicorn-2341.exe
916	Unicorn-60909.exe
3476	Unicorn-39019.exe
2392	Unicorn-49233.exe
3188	Unicorn-17115.exe
1420	Unicorn-44692.exe
3636	Unicorn-34843.exe
1308	Unicorn-22399.exe
2248	Unicorn-2917.exe
3436	Unicorn-60307.exe
1148	Unicorn-60559.exe
2520	Unicorn-63252.exe
4928	Unicorn-54337.exe
3492	Unicorn-64451.exe
3208	Unicorn-58997.exe
4800	Unicorn-65027.exe
2756	Unicorn-34301.exe
896	Unicorn-54721.exe
416	Unicorn-34685.exe
2540	Unicorn-32547.exe
1236	Unicorn-32547.exe
2972	Unicorn-36631.exe
3312	Unicorn-55105.exe
4524	Unicorn-20295.exe
1216	Unicorn-22241.exe
1552	Unicorn-35815.exe
5112	Unicorn-50835.exe
3560	Unicorn-35623.exe
492	Unicorn-813.exe
3768	Unicorn-30793.exe
3744	Unicorn-3885.exe
224	Unicorn-45738.exe
556	Unicorn-25339.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
1304	2024	WerFault.exe	102
9556	9016	WerFault.exe	338
2244	5424	WerFault.exe	248
10656	5424	WerFault.exe	248
1840	5908	WerFault.exe	201
10860	7140	WerFault.exe	245
14724	6316	WerFault.exe	265
14960	6316	WerFault.exe	265
10028	7164	WerFault.exe	247

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe
1212	Unicorn-17277.exe
1292	Unicorn-44879.exe
3524	Unicorn-6539.exe
1064	Unicorn-1454.exe
3296	Unicorn-36265.exe
3980	Unicorn-44525.exe
3800	Unicorn-34873.exe
880	Unicorn-60551.exe
1152	Unicorn-54884.exe
1720	Unicorn-25549.exe
3140	Unicorn-35663.exe
1436	Unicorn-16923.exe
2024	Unicorn-34271.exe
2108	Unicorn-30108.exe
3320	Unicorn-56851.exe
3692	Unicorn-36815.exe
1344	Unicorn-43591.exe
376	Unicorn-8802.exe
4592	Unicorn-4618.exe
3148	Unicorn-23577.exe
3460	Unicorn-8994.exe
4308	Unicorn-4910.exe
2152	Unicorn-3519.exe
1232	Unicorn-62279.exe
1640	Unicorn-19109.exe
4416	Unicorn-13633.exe
3500	Unicorn-29506.exe
3700	Unicorn-53349.exe
4856	Unicorn-10675.exe
1728	Unicorn-15771.exe
1448	Unicorn-2341.exe
916	Unicorn-60909.exe
1716	Unicorn-36597.exe
2392	Unicorn-49233.exe
3476	Unicorn-39019.exe
3188	Unicorn-17115.exe
1420	Unicorn-44692.exe
1308	Unicorn-22399.exe
3636	Unicorn-34843.exe
2248	Unicorn-2917.exe
3436	Unicorn-60307.exe
1148	Unicorn-60559.exe
2520	Unicorn-63252.exe
3492	Unicorn-64451.exe
4928	Unicorn-54337.exe
3208	Unicorn-58997.exe
2756	Unicorn-34301.exe
4800	Unicorn-65027.exe
2972	Unicorn-36631.exe
3312	Unicorn-55105.exe
1236	Unicorn-32547.exe
2540	Unicorn-32547.exe
416	Unicorn-34685.exe
4524	Unicorn-20295.exe
1216	Unicorn-22241.exe
1552	Unicorn-35815.exe
5112	Unicorn-50835.exe
3560	Unicorn-35623.exe
4256	Unicorn-25339.exe
844	Unicorn-29322.exe
492	Unicorn-813.exe
556	Unicorn-25339.exe
3744	Unicorn-3885.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1212	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	90
PID 2120 wrote to memory of 1212	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	90
PID 2120 wrote to memory of 1212	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	90
PID 1212 wrote to memory of 1292	1212	Unicorn-17277.exe	91
PID 1212 wrote to memory of 1292	1212	Unicorn-17277.exe	91
PID 1212 wrote to memory of 1292	1212	Unicorn-17277.exe	91
PID 2120 wrote to memory of 3524	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	92
PID 2120 wrote to memory of 3524	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	92
PID 2120 wrote to memory of 3524	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	92
PID 1292 wrote to memory of 1064	1292	Unicorn-44879.exe	93
PID 1292 wrote to memory of 1064	1292	Unicorn-44879.exe	93
PID 1292 wrote to memory of 1064	1292	Unicorn-44879.exe	93
PID 2120 wrote to memory of 3980	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	94
PID 2120 wrote to memory of 3980	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	94
PID 2120 wrote to memory of 3980	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	94
PID 3524 wrote to memory of 3296	3524	Unicorn-6539.exe	95
PID 3524 wrote to memory of 3296	3524	Unicorn-6539.exe	95
PID 3524 wrote to memory of 3296	3524	Unicorn-6539.exe	95
PID 1212 wrote to memory of 3800	1212	Unicorn-17277.exe	96
PID 1212 wrote to memory of 3800	1212	Unicorn-17277.exe	96
PID 1212 wrote to memory of 3800	1212	Unicorn-17277.exe	96
PID 1064 wrote to memory of 880	1064	Unicorn-1454.exe	97
PID 1064 wrote to memory of 880	1064	Unicorn-1454.exe	97
PID 1064 wrote to memory of 880	1064	Unicorn-1454.exe	97
PID 1292 wrote to memory of 1152	1292	Unicorn-44879.exe	98
PID 1292 wrote to memory of 1152	1292	Unicorn-44879.exe	98
PID 1292 wrote to memory of 1152	1292	Unicorn-44879.exe	98
PID 3296 wrote to memory of 1720	3296	Unicorn-36265.exe	99
PID 3296 wrote to memory of 1720	3296	Unicorn-36265.exe	99
PID 3296 wrote to memory of 1720	3296	Unicorn-36265.exe	99
PID 3980 wrote to memory of 3140	3980	Unicorn-44525.exe	100
PID 3980 wrote to memory of 3140	3980	Unicorn-44525.exe	100
PID 3980 wrote to memory of 3140	3980	Unicorn-44525.exe	100
PID 2120 wrote to memory of 1436	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	101
PID 2120 wrote to memory of 1436	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	101
PID 2120 wrote to memory of 1436	2120	c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe	101
PID 3524 wrote to memory of 2024	3524	Unicorn-6539.exe	102
PID 3524 wrote to memory of 2024	3524	Unicorn-6539.exe	102
PID 3524 wrote to memory of 2024	3524	Unicorn-6539.exe	102
PID 3800 wrote to memory of 3320	3800	Unicorn-34873.exe	103
PID 3800 wrote to memory of 3320	3800	Unicorn-34873.exe	103
PID 3800 wrote to memory of 3320	3800	Unicorn-34873.exe	103
PID 1212 wrote to memory of 2108	1212	Unicorn-17277.exe	104
PID 1212 wrote to memory of 2108	1212	Unicorn-17277.exe	104
PID 1212 wrote to memory of 2108	1212	Unicorn-17277.exe	104
PID 880 wrote to memory of 3692	880	Unicorn-60551.exe	105
PID 880 wrote to memory of 3692	880	Unicorn-60551.exe	105
PID 880 wrote to memory of 3692	880	Unicorn-60551.exe	105
PID 1064 wrote to memory of 1344	1064	Unicorn-1454.exe	106
PID 1064 wrote to memory of 1344	1064	Unicorn-1454.exe	106
PID 1064 wrote to memory of 1344	1064	Unicorn-1454.exe	106
PID 1152 wrote to memory of 376	1152	Unicorn-54884.exe	107
PID 1152 wrote to memory of 376	1152	Unicorn-54884.exe	107
PID 1152 wrote to memory of 376	1152	Unicorn-54884.exe	107
PID 1292 wrote to memory of 4592	1292	Unicorn-44879.exe	108
PID 1292 wrote to memory of 4592	1292	Unicorn-44879.exe	108
PID 1292 wrote to memory of 4592	1292	Unicorn-44879.exe	108
PID 1720 wrote to memory of 3148	1720	Unicorn-25549.exe	109
PID 1720 wrote to memory of 3148	1720	Unicorn-25549.exe	109
PID 1720 wrote to memory of 3148	1720	Unicorn-25549.exe	109
PID 3140 wrote to memory of 4308	3140	Unicorn-35663.exe	110
PID 3140 wrote to memory of 4308	3140	Unicorn-35663.exe	110
PID 3140 wrote to memory of 4308	3140	Unicorn-35663.exe	110
PID 1436 wrote to memory of 3460	1436	Unicorn-16923.exe	111

C:\Users\Admin\AppData\Local\Temp\c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe
"C:\Users\Admin\AppData\Local\Temp\c1f55e37b8c4ca8277f8df8032301173f6e414a2b87ff011b74d2adf0efa246a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1454.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26273.exe
        9⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        10⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        10⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        10⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        9⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        10⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10191.exe
        10⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56069.exe
        9⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14451.exe
        9⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7559.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        9⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        9⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        9⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53792.exe
        8⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        7⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        9⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61468.exe
        9⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
        9⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
        9⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47141.exe
        8⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24548.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8992.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52350.exe
        8⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33376.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50467.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        7⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        9⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        9⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35073.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18282.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14962.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9402.exe
        8⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 508
        8⤵
        Program crash
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9792.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3429.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7502.exe
        7⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
        7⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        6⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        9⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-435.exe
        9⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        9⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2723.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        9⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        9⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        9⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-680.exe
        8⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45815.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        8⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38561.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29102.exe
        7⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65006.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54550.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        7⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
        6⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-592.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        8⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50569.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30133.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8328.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41737.exe
        8⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41591.exe
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20263.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43518.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        6⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        7⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        6⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        7⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21405.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        6⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50337.exe
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41145.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33986.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34671.exe
        5⤵
        
        PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5872.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44784.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        8⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        8⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33066.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24717.exe
        8⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        8⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-140.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37329.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        7⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10146.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32547.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56081.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        7⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15778.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        7⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49734.exe
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        6⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        6⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14932.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        6⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43605.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3299.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48816.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        6⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57787.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        6⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35083.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18184.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38060.exe
        5⤵
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45988.exe
        8⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64663.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        7⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48650.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        7⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10710.exe
        7⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        6⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2162.exe
        6⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48842.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        6⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1747.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
        5⤵
        
        PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        5⤵
        Executes dropped EXE
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47913.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33745.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
        7⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6667.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        6⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39401.exe
        5⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5749.exe
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        5⤵
        
        PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
        5⤵
        
        PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19795.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45007.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10992.exe
      4⤵
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
      4⤵
      PID:7000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64451.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20051.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30897.exe
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        8⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
        8⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4539.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42533.exe
        7⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        7⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        6⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 636
        7⤵
        Program crash
        
        PID:14724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 636
        7⤵
        Program crash
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64840.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1942.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        5⤵
        Executes dropped EXE
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37933.exe
        7⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62422.exe
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12958.exe
        6⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22410.exe
        5⤵
        
        PID:32
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31847.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37819.exe
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24654.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        5⤵
        
        PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54482.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        6⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 632
        7⤵
        Program crash
        
        PID:2244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 632
        7⤵
        Program crash
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        6⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe
        7⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35281.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38747.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        6⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-88.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35545.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        5⤵
        
        PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
        5⤵
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59002.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4934.exe
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        5⤵
        
        PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49089.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13270.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34936.exe
      4⤵
      PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        6⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41223.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        7⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5053.exe
        6⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        7⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47237.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27403.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42157.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26380.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27637.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63433.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        6⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26433.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33526.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4851.exe
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30159.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16771.exe
        5⤵
        
        PID:14448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63737.exe
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
      4⤵
      PID:16748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16117.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42567.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-585.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7715.exe
        5⤵
        
        PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54881.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2189.exe
        5⤵
        
        PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        5⤵
        
        PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6511.exe
      4⤵
      PID:456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
      4⤵
      PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21109.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27050.exe
        5⤵
        
        PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        5⤵
        
        PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33186.exe
      4⤵
      PID:8532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33801.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
      4⤵
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41529.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57777.exe
      4⤵
      PID:872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
    3⤵
    PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
      4⤵
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      4⤵
      PID:16964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
    3⤵
    PID:9468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25745.exe
    3⤵
    PID:12280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-937.exe
    3⤵
    PID:15440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25339.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        8⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7164 -s 644
        9⤵
        Program crash
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        8⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4066.exe
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-130.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54289.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        8⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29899.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        8⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46809.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        7⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58286.exe
        6⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48373.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44215.exe
        6⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        8⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17129.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        7⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11763.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42307.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        6⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7897.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7424.exe
        6⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4550.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30954.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17800.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
        5⤵
        
        PID:15276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56517.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40387.exe
        6⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23113.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41197.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        6⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46199.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        5⤵
        
        PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29322.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
        5⤵
        
        PID:7140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 636
        6⤵
        Program crash
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60170.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        5⤵
        
        PID:14484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55920.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        5⤵
        
        PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
      4⤵
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
        5⤵
        
        PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52611.exe
      4⤵
      PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
      4⤵
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 632
      4⤵
      Program crash
      PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34685.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65105.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64088.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        6⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37367.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49324.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61861.exe
        5⤵
        
        PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      4⤵
      PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        5⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
        5⤵
        
        PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
      4⤵
      PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
      4⤵
      PID:17124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
    3⤵
    PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30809.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12645.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30604.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
      4⤵
      PID:14468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      4⤵
      PID:14668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
    3⤵
    PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
      4⤵
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
      4⤵
      PID:13640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
    3⤵
    PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31080.exe
    3⤵
    PID:11072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
    3⤵
    PID:14408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13704.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16936.exe
        7⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57721.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
        7⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63939.exe
        6⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        5⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4684.exe
        6⤵
        
        PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49515.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        5⤵
        
        PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
      4⤵
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53641.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8212.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
        5⤵
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40489.exe
      4⤵
      PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10344.exe
      4⤵
      PID:16904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54721.exe
      4⤵
      Executes dropped EXE
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32303.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35054.exe
        6⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        5⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        6⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        5⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29875.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45333.exe
        5⤵
        
        PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
        5⤵
        
        PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62640.exe
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
      4⤵
      PID:436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65271.exe
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
      4⤵
      PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64830.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
      4⤵
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46558.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
      4⤵
      PID:14992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61681.exe
    3⤵
    PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
      4⤵
      PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26915.exe
    3⤵
    PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
    3⤵
    PID:12708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
    3⤵
    PID:14380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-242.exe
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54176.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33754.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47875.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46485.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
      4⤵
      PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61463.exe
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16424.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-735.exe
      4⤵
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
      4⤵
      PID:8088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        5⤵
        
        PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
      4⤵
      PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
        5⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23429.exe
        5⤵
        
        PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61043.exe
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
    3⤵
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62199.exe
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19765.exe
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      4⤵
      PID:14648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61088.exe
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
    3⤵
    PID:9188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
    3⤵
    PID:11084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39477.exe
    3⤵
    PID:9556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58968.exe
    3⤵
    PID:16516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65027.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65027.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15758.exe
        5⤵
        
        PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
        5⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25150.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4991.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24800.exe
      4⤵
      PID:12816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-554.exe
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54820.exe
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
      4⤵
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
      4⤵
      PID:15312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
    3⤵
    PID:9016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9016 -s 212
      4⤵
      Program crash
      PID:9556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
    3⤵
    PID:10276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
    3⤵
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
    3⤵
    PID:12476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9987.exe
  2⤵
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18209.exe
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      4⤵
      PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1831.exe
      4⤵
      PID:15820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41146.exe
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63434.exe
    3⤵
    PID:16644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
  2⤵
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62687.exe
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
    3⤵
    PID:13616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
    3⤵
    PID:16796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
  2⤵
  PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
    3⤵
    PID:17280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27421.exe
  2⤵
  PID:10036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
  2⤵
  PID:12664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
  2⤵
  PID:14432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
1⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 9016 -ip 9016
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5424 -ip 5424
1⤵
PID:9456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5908 -ip 5908
1⤵
PID:10864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7140 -ip 7140
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4680 -ip 4680
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7152 -ip 7152
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6316 -ip 6316
1⤵
PID:12648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7164 -ip 7164
1⤵
PID:13940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe

Filesize
184KB

MD5
5a7fb4c9d135e051613131f761a8df77

SHA1
6fe9ec6a8e17a0393e4165429307d0899395ec68

SHA256
b7b6dc323a2b2bfb210a750b0fe59e74986744a577d051238cc2d843aaa334c2

SHA512
0c74656f20eeda32d18bc345568832c8529e47bde635512e9c3d60d898670a4ab1a80484a9ade19e56005db7d9ca822f9805d912b153de7ac29e13248d92f7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13633.exe

Filesize
184KB

MD5
ff965de1fc820df179e05c962b4b1825

SHA1
8dd58a199e843382dfd819fd9842fa59f73a6668

SHA256
8151ee2e96589a50fe56273a7e7a5341e9ef2827bbbf10904d5214bc4ce80be0

SHA512
732802b0232b19b95f30d33937b00fc12d40cd9bbb1bde93ad61ad552340228cb253246e302186237dab37312a5fc926b3cb4e14a459d3dfe93f5d06411a96d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1454.exe

Filesize
184KB

MD5
e6b40fe9cf111e6da77f439bcf1401ee

SHA1
c8516ce6e17a4027809f6591a0ef064560e4b72c

SHA256
c54d886504f6b40166a68ce5a5cf971add1ae990457670b033b20cc2330e0819

SHA512
33efde01520b11b4017264400e8a5f07e3765c9e1108bd780f4422fc0d3ba7c442102871f01b50c1d4279b6916b1449f56284fd5916d4f42b37edbf2ab288dc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe

Filesize
184KB

MD5
d55da136b2b1d3ffb4c98660b8224e71

SHA1
557f7694c2e9999508982066b7f5cd783e88e4d3

SHA256
c2200b214b3e0f07624a7eb5d442c011644471c28c15399a0249e109e807adb4

SHA512
a0fcc666c562a10ff01de12a74590f5816a61db1560dcbefffb1b9b5c0136a28d1b222221249c0cdd1b420aff52bb700cf3dcc37ebdc4153267d111069d53a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16923.exe

Filesize
184KB

MD5
f3acf02cc119f9b5a4c7480292c83b85

SHA1
60c931e78d2475a6d43632250762f882787464e6

SHA256
7b05fbe33d0b34b6b4fd6d94caab730c8009b12053a78d8f96a05e27dd1dae56

SHA512
f78628afa7dbae29f3d61d041e78f83acd9cebf9c8ed0b46fe39a1306db005a9535fff52d89a033a9e3f15c86a3fcc830b27d3557d258e5851c6448f12e6953b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17277.exe

Filesize
184KB

MD5
f5ecce127b8320d46ed6810398ab12a9

SHA1
3dc2cae2fe9a538f304b87e3fd1f398778353bac

SHA256
2be5e736aaddb6715be4aa73012f03b1d7525af370fd269e46b8947f08b174d3

SHA512
b6c2095495591c80ef805b47e291032e4d42cb23deef510f72520ed16bc2529ea76d88cc83e9714f4927f66762f3589726ad165b1cd3e92ad4f4fb407e62343d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19109.exe

Filesize
184KB

MD5
13b08d851479c78eacf24af3f5a18b26

SHA1
9f5a2739d2aa31c00a4e9d56bc1053827889f9c0

SHA256
6b8dbc350323cbcddb3165ea0ee9f3c394b25dfa88fe54583d86fcac91e9a9b7

SHA512
ca461a458192efeea62449f2efb0d3c3273792436ec8e1f50cc2f562fbadabda80df78063a6ea5e343a64450f9acd76d5d10c5a52269d23151ae9c633a76fd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe

Filesize
184KB

MD5
2dc19567b0d5e0cb3bc9f35a57511a30

SHA1
f15345754c0ba42f3445c0dfc610f5c91986f986

SHA256
e80994c6dbce43504cfb264744a4c4b4b87c4baf9bda75284f2fffe9e49f96a8

SHA512
f7ee1ad21a4702d28196fb264aef4b15b227d3ecef94b180efbf33e2f511a03b849e868057062ca3d39ea7fb9c4be0bcaa488041b5487fdff8a91a31d9782a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23577.exe

Filesize
184KB

MD5
9664e4e53bed43338b714e1308e8af64

SHA1
3be9daf758afd811fdf9486003d8784349c9f6ed

SHA256
4cd3becacf2f8486a614399a3a0d224595b10bdda160556687373ee1b4501f0c

SHA512
6b4d4b6285ea4fb3b509da53dc3452bdcf97ea60f8b3fc0dc8d7b15c969c6c4dd3fc8da88f24bfeb229ce461e41a80ebc15e63403ae569ec1dae3a49ceb8a539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe

Filesize
184KB

MD5
492cae505d872be9829fa16c9c393708

SHA1
8eed37c82ffb399f47b05092a3865fa0656f52f2

SHA256
233737c2acfae9d76386c83849dae1fa146fbbf19ed96869e835c327766d107b

SHA512
fa5bb4d4f59ca0bbc02ec05dab245af7cb5381fba1ed5ea1ccc9baebf769b0480c79549c8b88f46f76d75a4463e3511660e2be2697481b8ee37f83d4de97b88d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe

Filesize
184KB

MD5
70c44be851468a68cf7d87eb0d78d36c

SHA1
45f2e885263cf38287a605d7a9e8e7c894d6c9f6

SHA256
2a1cb5a33d6ffc2b6ff0150b96394cd5d53c034f68252b9212c425751bae6162

SHA512
eccc901e59ad5142129454dd1fc277f37f48158b43f27c49814cc8b3a93bcf547578dcdaa41f786a72dfef6fcefa29a25fddf57e6440e3bebb8d92eec0b2cfcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe

Filesize
184KB

MD5
e79b1c8f1be074d1371766ba20cb19cb

SHA1
db5e46930332e80b681325bd7f7714e045570ba7

SHA256
87f7fa616f4cc9e78e44a381002c991799b52e8c1070a85d53cef7ca20574cee

SHA512
339345a2a16f32d7fb3aa7e34891d3d3c2c741329df1f0ea80887a161fb6ee600e2168e3fa1ccfe9c99f1577eb08195115b296355bd917518da4b35d84d9de32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34271.exe

Filesize
184KB

MD5
9ae17eb7a6abe8c78e5faba44cb65e61

SHA1
9a08bafac30fa4fb543e0cd96bffd83ae459aa20

SHA256
e639e5ec2eca3cd0347f2780673b87573822729a1b5f2bc34d0c05c1a19aaf74

SHA512
6a223a72c3978ca52c93e0170c5b4e55dd5a9dccb1e70ed44050845c910e459d5025242a8b944c3451dd8f6fb99898a063684f21eaf7993a4cce33dcc2b55892

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34793.exe

Filesize
184KB

MD5
cee8afcd2f4e797d810f22c14de7225a

SHA1
52df1ed2950b8ea0859990053cc5a4f8d8beb1fb

SHA256
aaf9065cea93d84c86f7dbe9faf186ce9e0b2686d2b5ed0d3f2057f1e6c1a536

SHA512
b8566c71bf3a5c3630b8b24cdecc15439490593481a5b6c228029ed491a037abd01a84cb82a721ad6f44e5ef78547bc4b40528d1d108b74384ceba634f121ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34873.exe

Filesize
184KB

MD5
68f46f1938bc128feff57707e7b68cc9

SHA1
f0e01e0ecb899f8072d24e708df6cd905795712d

SHA256
006edef90adb9e54e0b6d59ce6ae9bb5ca898906439f722a44e0d14affc08360

SHA512
dc2b0172e02dddbef96f993311f16bb7ce0d404f3e6f40a6a44bbd1f7e67b652ab059ed3bd2463b33bcafdf49780c74dcb567d6b56d7c344b3d777e1ab54263f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe

Filesize
184KB

MD5
f5234f242c6d27e82fcf3671f4d63191

SHA1
0625dd59b5f21286c998aa796b91d473528725cb

SHA256
7117f9bc8e1c7967f7d69626b341b1de9815c02f1a3be39bba062f01c8f60e06

SHA512
3786d92c8563e0c5f5e321d28efb66ee94968cf1882898ab0d49b5ac819d618fdea459fbe3bf8d291553de51080557bc57c20b1939ef924367df4383834111ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe

Filesize
184KB

MD5
918e621e5100d853dc75b48c41274dc6

SHA1
7bfa2ecb140d80efaea12380dbafdcbef6ab0c34

SHA256
db772352638d02c86f33768425b4324ab0c3ece06f4bddb3ff983ed06472f85e

SHA512
8bf5285f03a09d1d753b6bf3d59528c73286a4f23510122ddb24f92ae89e5af26b4da37b213825d2f5e2c1bce9ec99b23d5d6ad037fab487e95c1e7ed07fa271

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36265.exe

Filesize
184KB

MD5
9659d50c9da6e5be9d6c74f6e0bdcee6

SHA1
1ba3eaaa472699149d4a097ae98d15d634aea20e

SHA256
9592ace94efff9698f69bfacce29a30b69b704ee7525f00d8660b344acbf54bc

SHA512
cd0b4e921280f7f3ab8d60fd1effaf77f182e47fc26840f09adf5201673d49792e9e09a6cfbec07db7f43d4e38fcfaab8427e0b639a2ba414780f7955c00aa55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe

Filesize
184KB

MD5
d315cb6c8050811da98b07af27f3288e

SHA1
51ba5f6b6fb0af73a4067ede2b5dcece18269363

SHA256
b9e18b73e0c5f37442e87f7352eebc53916876cdae26889a7eb3b1b4465a27fa

SHA512
be10a751aa36c7537fec5bb2d40be46eccc781415d532c638cbcedf20cdc341993cb4f2a1a0edefd63b9764e5e76815a3cc275a7627da4a69804339ff1ca0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe

Filesize
184KB

MD5
fa4e4c144eccabc7ac9bf31cea27f632

SHA1
e42fea3e82b8f56b12d5e31b970d6bd73a3c1241

SHA256
56a927522a0aef7f888be561b87059b271986d12a4f7d8eb6403db1e1a5c2c16

SHA512
f31db7c3bb2835792285bfac02a6184fa68159c0e72d0e93a32f8bd61c6bcf0dbaf5a50c7172dcfbd76d23ad56901b3f21d6c8073f959997bebdd959c5f42113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe

Filesize
184KB

MD5
ab595fdefdde4385b30e678eee7a2f53

SHA1
7d78056be47f2e61c03c70daa851ec6e2bd2410e

SHA256
a8dcb2cf73584783fabab316e520e0667cc049f53a0059c2707fd87b2c995add

SHA512
d8ed239d081412c9fd385d7b92ee92bf4975261a994282d17a0967176694e096bb2181ae4ac0e289a7d2557477a1e8ee8766e2b887a432fa516eb0356fe7e047

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe

Filesize
184KB

MD5
83b2568c76e01dc8478eab6c0fe191a0

SHA1
9ee4e42080a335b2d40162c6d5b53126998cdbaa

SHA256
90397317a7bac79cf0d4853d6590a57ad9f4b7847fe6519a49b54b97ccd81646

SHA512
fbe777ad8295b5b9b9a10039eb86f2fa643474e74ee392833496da461935db136d5bc08e41adcaad704ddf01a2e5aefa56e96958bd4bc9f79689abd2b0fc5f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe

Filesize
184KB

MD5
1d44a7683e9d5473bf3e21de03494541

SHA1
00bdb55e15f7a1cba9d3bce6439770099077a93d

SHA256
555f79ce44ec6a9eef01c0e928e1ce68ed2f5e073ef60c87e2c2e8d31c0606ba

SHA512
e47d2151558733e3b7462d3afb5f7fd1ea061cd3e45a54023e6ba8c50f986c37e8795647d0cb607ce7bfcf6b038ffc0b138649a531923edb545193fa372c59bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe

Filesize
184KB

MD5
8c7bbf2fe36d556cea27468b78a33351

SHA1
3c1cd2b110bce9ef4c90d2fcf40baa5f01874e36

SHA256
cbeacd0b472aa2252716d9fec845bb0b5a1ccee186e3d2cadb1a7bf8f9c26f46

SHA512
4d911027917148d380fd2a0a3aea2a06b512ede2d4dbeb058dc8458a5a7380750083eb68260b04106d729732aa9026baac7b7f69d00d01e7458e0dc65e2a8ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4618.exe

Filesize
184KB

MD5
e6a8ebc837eb26e7c0ccbc57627a8de0

SHA1
4319577e5eb7e1bb2e1d2847cdac957a03618a35

SHA256
7e5e7221e66f4d7b0e8a4a9a8f28db93acbd9c88530f6afce0541a97e8e03116

SHA512
ff9f75431ebbe1e899330a2961af495b0c4474b0d151221ef807b4428e0af2c9606f6c47780a4f9f328ef01e578dc28ac69a46be4b4767a5d72622a3f2f499ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe

Filesize
184KB

MD5
c6e90cf4240b010bcac880af5d7d2534

SHA1
20494a15bf76945eb291f381d045a7ca22f24d5f

SHA256
51ebb55ef7622ef8c987b25997a7d123b100516b4b02480984ae525bce396b4f

SHA512
a53d27eb4ee1e052744ddbb61c2a1dd1d9b7f03732df7d26426430fe412f404d5054d60716788e04c578adb6179f92f8215be4741f00987ceb5634ac1847ada4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe

Filesize
184KB

MD5
3c9f8a9498260df2fd60f0f4e1a0d312

SHA1
4ff96c0553545028d195a4983818a3aeaaa2fadc

SHA256
a9c061a3a5678c830c34b57fd6f00acb273f9eeb986bd9d7374823c9b4c6c1b8

SHA512
c4669cca099eff785a6cc172a2ebef31f89984a3ad7c0e93e7a79400745b6866e5f9f8ded2c5cbffdad5a1b10a4313caac9a96219491e7b2945b131e956b3b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54884.exe

Filesize
184KB

MD5
5724910cfc0183e9397aa1f1a5745fcc

SHA1
cb07e44ce3a02a540098509c01314c37464cd8d0

SHA256
5cf071763741f1d2c831bc80822b8c7beaa791aaf3f0aec7ade0c95be01fa772

SHA512
4f8ad1df508cda3b3547954f501f178c3dcbff17c96b0a904c3f1903237b747aaa3a2b6953c4b3089a0286e818ddfd0c5c18b0349cda6fb07b5ab59e01fb37ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe

Filesize
184KB

MD5
7de327e2f27e95471204ca0600132180

SHA1
f83b4f18c33e6c93d6ee784e28dd52c41d94e918

SHA256
c18f68e2ad9bf9cacf211a1f0c1e3efc843e1a8eb9233652ec4ca1e7eb886b5d

SHA512
458b11139dfbcb325a39f0ea37234ffd816dfc2911d668f444acf327e578389ae8b2c908f25612822777ea525a6819392b81e34abe13db32bbd6cc165cb8ef37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe

Filesize
184KB

MD5
6b55a94d4862262fa913b69984e585d3

SHA1
897f028c2c65480f6bdea4f39550eb2a3bc88ac0

SHA256
510c14879b7b008e3bc6d8cec3d308f67cafa887c5e30b2eeed07c3bbfaffd3a

SHA512
7508c99d1f747dc9575f93766fcbb2160f5ce00718c84973206d9b751a6f5ce532149abd0831b23035fb5914750aaaf166d687838ff97dda810c8c724c7fde39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe

Filesize
184KB

MD5
f3a07bcf40abdfbf4a54cd06edeb468b

SHA1
2c7fad6f0b7097de1a18b369d7a621ee7af9296d

SHA256
319b56964dc7263ea8b62dace0c024f9c91b1a385b3ec89fc7b421148a16a152

SHA512
84f4c51ae0c46046d5f5ad80160ef23c4d49577d604810d6282efafc913a5918f29713c0508328c13831e24ebad685b6b62c0665c171151be01d1a8564a52bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe

Filesize
184KB

MD5
90ef9b8ab5d2b6ca7279e99e2d28a49e

SHA1
d5c039e72dedc35d625408fd8b6679848e41957f

SHA256
8c428f0711eaaf98a2133e09a427da23015e463cfa6d67f90c18eedccfd3f182

SHA512
5148448c98df601742806203b99955de68a71dfdfc37402ecbe33db6a9cad959da7b08ef97d7606dd3de31616eb2d79e510fe5dd41183bdf01cf1171ba47987d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe

Filesize
184KB

MD5
c4f819471b0b2bb856eb7f22c96a52e5

SHA1
674ef053ea384e8548118d34b395006474adfe6c

SHA256
6e148d97defb65d02e528f12bbb0044baa59f5bb1778bbc4f462c7c64f2de7b5

SHA512
a5e5b34c0b90b538e2cbd26c2bd30711e489721b46beaf7e13ceb75960740d6f3e78ffb9b1b9c3c6d0a7ce418b26ac513574bc6d56aaa68400859871af516e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe

Filesize
184KB

MD5
f6a4a9545de5ce597c51903ce7e22ee7

SHA1
4474d5da1c50434402d383a0397e3fda521ab844

SHA256
4c1ee018d23c5206affe243ba02f3791d0ea05b2aec2149113a81a834d54ed72

SHA512
18265106ba2dba7a8e58f9c55d4403fae21e94a482736f7d29f4a6ac700801d7b33ff921e9b92c0fcd8d4148ec21b89983a5c679751a18d0f64e2c4a6aca95ac

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads