4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe
Size

184KB
MD5

748f873ff33b3abb7d5acff470980a9a
SHA1

58ca9f142c93071a1598479729cff4d643036ce9
SHA256

4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657
SHA512

6bae1e9bfb915bc6416e14ddc7536144f37fbe291623eab8f88d0461bbae5f5a37bf332626ea33dc3f1c3d1d6c44af9393551a8268b5f53c9d921bbbd12d7972
SSDEEP

3072:zU+anCo0/15NdyatZtp8ts0HlvnqnveuV:zU6oCbyaz8q0HlPqnveu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3380	Unicorn-46940.exe
4316	Unicorn-54122.exe
1628	Unicorn-60899.exe
3944	Unicorn-21004.exe
3184	Unicorn-21004.exe
5080	Unicorn-37432.exe
4116	Unicorn-23696.exe
2560	Unicorn-44522.exe
1028	Unicorn-32824.exe
3984	Unicorn-63572.exe
4564	Unicorn-63572.exe
1596	Unicorn-12425.exe
2356	Unicorn-61169.exe
3956	Unicorn-55304.exe
4384	Unicorn-41568.exe
2328	Unicorn-33806.exe
4300	Unicorn-17470.exe
3644	Unicorn-7718.exe
492	Unicorn-60348.exe
3192	Unicorn-61024.exe
4432	Unicorn-56940.exe
3096	Unicorn-56940.exe
1412	Unicorn-45243.exe
4724	Unicorn-20738.exe
4704	Unicorn-32990.exe
1800	Unicorn-24076.exe
2288	Unicorn-46634.exe
4804	Unicorn-37703.exe
4212	Unicorn-36420.exe
1356	Unicorn-42285.exe
1644	Unicorn-4807.exe
1576	Unicorn-5362.exe
5060	Unicorn-54563.exe
1540	Unicorn-19582.exe
708	Unicorn-28304.exe
3740	Unicorn-31642.exe
1724	Unicorn-29595.exe
3160	Unicorn-9083.exe
3688	Unicorn-62679.exe
3432	Unicorn-56722.exe
2896	Unicorn-38802.exe
2032	Unicorn-5383.exe
2996	Unicorn-40286.exe
3144	Unicorn-19774.exe
2564	Unicorn-19774.exe
4956	Unicorn-25804.exe
2312	Unicorn-19673.exe
4560	Unicorn-7329.exe
1452	Unicorn-31925.exe
224	Unicorn-28496.exe
432	Unicorn-13551.exe
892	Unicorn-44278.exe
3836	Unicorn-26980.exe
1436	Unicorn-52446.exe
1488	Unicorn-32602.exe
4336	Unicorn-28253.exe
1612	Unicorn-39378.exe
4600	Unicorn-5959.exe
3624	Unicorn-57853.exe
488	Unicorn-8652.exe
1192	Unicorn-62566.exe
1108	Unicorn-1683.exe
2948	Unicorn-26934.exe
3372	Unicorn-60998.exe

Program crash 23 IoCs

pid	pid_target	Process	procid_target
11048	6788	WerFault.exe	273
13228	6700	WerFault.exe	272
17080	14332	WerFault.exe	694
17116	14752	WerFault.exe	709
17108	14400	WerFault.exe	702
17168	14056	WerFault.exe	679
17244	14392	WerFault.exe	701
17280	2568	WerFault.exe	682
16536	14652	WerFault.exe	706
16544	15268	WerFault.exe	730
17036	15168	WerFault.exe	725
17044	14624	WerFault.exe	735
6808	15280	WerFault.exe	731
5476	13872	WerFault.exe	740
14308	15588	WerFault.exe	783
14780	13824	WerFault.exe	738
6908	15908	WerFault.exe	784
6668	16004	WerFault.exe	810
17204	15628	WerFault.exe	800
16612	15564	WerFault.exe	799
16696	16160	WerFault.exe	809
17192	5972	WerFault.exe	826
12188	7532	WerFault.exe	297

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6944	dwm.exe
Token: SeChangeNotifyPrivilege	6944	dwm.exe
Token: 33	6944	dwm.exe
Token: SeIncBasePriorityPrivilege	6944	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe
3380	Unicorn-46940.exe
4316	Unicorn-54122.exe
1628	Unicorn-60899.exe
3184	Unicorn-21004.exe
4116	Unicorn-23696.exe
3944	Unicorn-21004.exe
5080	Unicorn-37432.exe
2560	Unicorn-44522.exe
1028	Unicorn-32824.exe
1596	Unicorn-12425.exe
4564	Unicorn-63572.exe
3984	Unicorn-63572.exe
3956	Unicorn-55304.exe
4384	Unicorn-41568.exe
2356	Unicorn-61169.exe
2328	Unicorn-33806.exe
4300	Unicorn-17470.exe
3644	Unicorn-7718.exe
492	Unicorn-60348.exe
3096	Unicorn-56940.exe
4704	Unicorn-32990.exe
1412	Unicorn-45243.exe
4724	Unicorn-20738.exe
3192	Unicorn-61024.exe
4432	Unicorn-56940.exe
4804	Unicorn-37703.exe
1800	Unicorn-24076.exe
2288	Unicorn-46634.exe
1356	Unicorn-42285.exe
4212	Unicorn-36420.exe
1644	Unicorn-4807.exe
1576	Unicorn-5362.exe
5060	Unicorn-54563.exe
1540	Unicorn-19582.exe
708	Unicorn-28304.exe
3740	Unicorn-31642.exe
1724	Unicorn-29595.exe
3160	Unicorn-9083.exe
3688	Unicorn-62679.exe
3432	Unicorn-56722.exe
2032	Unicorn-5383.exe
2896	Unicorn-38802.exe
2996	Unicorn-40286.exe
3144	Unicorn-19774.exe
2564	Unicorn-19774.exe
4956	Unicorn-25804.exe
4560	Unicorn-7329.exe
2312	Unicorn-19673.exe
432	Unicorn-13551.exe
1436	Unicorn-52446.exe
224	Unicorn-28496.exe
892	Unicorn-44278.exe
1452	Unicorn-31925.exe
3836	Unicorn-26980.exe
4600	Unicorn-5959.exe
1488	Unicorn-32602.exe
1192	Unicorn-62566.exe
4336	Unicorn-28253.exe
1612	Unicorn-39378.exe
3624	Unicorn-57853.exe
488	Unicorn-8652.exe
1108	Unicorn-1683.exe
3840	Unicorn-50784.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3380	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	89
PID 5004 wrote to memory of 3380	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	89
PID 5004 wrote to memory of 3380	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	89
PID 3380 wrote to memory of 4316	3380	Unicorn-46940.exe	94
PID 3380 wrote to memory of 4316	3380	Unicorn-46940.exe	94
PID 3380 wrote to memory of 4316	3380	Unicorn-46940.exe	94
PID 5004 wrote to memory of 1628	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	95
PID 5004 wrote to memory of 1628	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	95
PID 5004 wrote to memory of 1628	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	95
PID 4316 wrote to memory of 3944	4316	Unicorn-54122.exe	97
PID 4316 wrote to memory of 3944	4316	Unicorn-54122.exe	97
PID 4316 wrote to memory of 3944	4316	Unicorn-54122.exe	97
PID 1628 wrote to memory of 3184	1628	Unicorn-60899.exe	98
PID 1628 wrote to memory of 3184	1628	Unicorn-60899.exe	98
PID 1628 wrote to memory of 3184	1628	Unicorn-60899.exe	98
PID 5004 wrote to memory of 5080	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	99
PID 5004 wrote to memory of 5080	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	99
PID 5004 wrote to memory of 5080	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	99
PID 3380 wrote to memory of 4116	3380	Unicorn-46940.exe	100
PID 3380 wrote to memory of 4116	3380	Unicorn-46940.exe	100
PID 3380 wrote to memory of 4116	3380	Unicorn-46940.exe	100
PID 3184 wrote to memory of 2560	3184	Unicorn-21004.exe	103
PID 3184 wrote to memory of 2560	3184	Unicorn-21004.exe	103
PID 3184 wrote to memory of 2560	3184	Unicorn-21004.exe	103
PID 1628 wrote to memory of 1028	1628	Unicorn-60899.exe	104
PID 1628 wrote to memory of 1028	1628	Unicorn-60899.exe	104
PID 1628 wrote to memory of 1028	1628	Unicorn-60899.exe	104
PID 4116 wrote to memory of 4564	4116	Unicorn-23696.exe	106
PID 4116 wrote to memory of 4564	4116	Unicorn-23696.exe	106
PID 4116 wrote to memory of 4564	4116	Unicorn-23696.exe	106
PID 3944 wrote to memory of 3984	3944	Unicorn-21004.exe	105
PID 3944 wrote to memory of 3984	3944	Unicorn-21004.exe	105
PID 3944 wrote to memory of 3984	3944	Unicorn-21004.exe	105
PID 5080 wrote to memory of 1596	5080	Unicorn-37432.exe	107
PID 5080 wrote to memory of 1596	5080	Unicorn-37432.exe	107
PID 5080 wrote to memory of 1596	5080	Unicorn-37432.exe	107
PID 5004 wrote to memory of 2356	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	108
PID 5004 wrote to memory of 2356	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	108
PID 5004 wrote to memory of 2356	5004	4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe	108
PID 4316 wrote to memory of 4384	4316	Unicorn-54122.exe	110
PID 4316 wrote to memory of 4384	4316	Unicorn-54122.exe	110
PID 4316 wrote to memory of 4384	4316	Unicorn-54122.exe	110
PID 3380 wrote to memory of 3956	3380	Unicorn-46940.exe	109
PID 3380 wrote to memory of 3956	3380	Unicorn-46940.exe	109
PID 3380 wrote to memory of 3956	3380	Unicorn-46940.exe	109
PID 2560 wrote to memory of 2328	2560	Unicorn-44522.exe	111
PID 2560 wrote to memory of 2328	2560	Unicorn-44522.exe	111
PID 2560 wrote to memory of 2328	2560	Unicorn-44522.exe	111
PID 1028 wrote to memory of 4300	1028	Unicorn-32824.exe	112
PID 1028 wrote to memory of 4300	1028	Unicorn-32824.exe	112
PID 1028 wrote to memory of 4300	1028	Unicorn-32824.exe	112
PID 3184 wrote to memory of 3644	3184	Unicorn-21004.exe	113
PID 3184 wrote to memory of 3644	3184	Unicorn-21004.exe	113
PID 3184 wrote to memory of 3644	3184	Unicorn-21004.exe	113
PID 1628 wrote to memory of 492	1628	Unicorn-60899.exe	114
PID 1628 wrote to memory of 492	1628	Unicorn-60899.exe	114
PID 1628 wrote to memory of 492	1628	Unicorn-60899.exe	114
PID 3984 wrote to memory of 3192	3984	Unicorn-63572.exe	115
PID 3984 wrote to memory of 3192	3984	Unicorn-63572.exe	115
PID 3984 wrote to memory of 3192	3984	Unicorn-63572.exe	115
PID 1596 wrote to memory of 4432	1596	Unicorn-12425.exe	116
PID 4564 wrote to memory of 3096	4564	Unicorn-63572.exe	117
PID 1596 wrote to memory of 4432	1596	Unicorn-12425.exe	116
PID 1596 wrote to memory of 4432	1596	Unicorn-12425.exe	116

C:\Users\Admin\AppData\Local\Temp\4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe
"C:\Users\Admin\AppData\Local\Temp\4f972f05ea0996d0a2c1a21fcd179eaee6cafdb7369f14c17042788128901657.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7329.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        9⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        9⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19768.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35693.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26383.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        8⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        8⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        8⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        7⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        7⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28496.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        9⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8476.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15849.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18621.exe
        8⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34103.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
        7⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44857.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16997.exe
        7⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39097.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40905.exe
        6⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63044.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23674.exe
        6⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31518.exe
        9⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        9⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
        8⤵
        
        PID:14400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14400 -s 464
        9⤵
        Program crash
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        7⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38409.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        7⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        7⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4605.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        8⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42819.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38958.exe
        7⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        6⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        8⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        7⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35190.exe
        7⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        6⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46508.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
        6⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27854.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        9⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        9⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        8⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        7⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19062.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19663.exe
        6⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        5⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12503.exe
        6⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46406.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30510.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53766.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6603.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21058.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        7⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21366.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47802.exe
        6⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        6⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39832.exe
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2849.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        5⤵
        
        PID:14056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14056 -s 436
        6⤵
        Program crash
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
        5⤵
        
        PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36374.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        7⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24812.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
        7⤵
        
        PID:15280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15280 -s 452
        8⤵
        Program crash
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        7⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6530.exe
        7⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        6⤵
        
        PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17718.exe
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        6⤵
        
        PID:15168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15168 -s 444
        7⤵
        Program crash
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55373.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28253.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18510.exe
        7⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        6⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        6⤵
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7899.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64040.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56795.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        5⤵
        
        PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
      4⤵
      PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39695.exe
      4⤵
      PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55684.exe
      4⤵
      PID:7172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35856.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23328.exe
        9⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        9⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        9⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9820.exe
        8⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22098.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        8⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42426.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61920.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16314.exe
        7⤵
        
        PID:15628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15628 -s 476
        8⤵
        Program crash
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44434.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        7⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13024.exe
        6⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13872 -s 452
        7⤵
        Program crash
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        6⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        8⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        7⤵
        
        PID:13824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13824 -s 468
        8⤵
        Program crash
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        6⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        7⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27203.exe
        6⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23552.exe
        6⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50018.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19828.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8151.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        7⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52926.exe
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6060.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42830.exe
        5⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        5⤵
        
        PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61860.exe
        8⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3579.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        7⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55228.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        7⤵
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27975.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22378.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51289.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55652.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49401.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        7⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 436
        8⤵
        Program crash
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        6⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7298.exe
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15492.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29559.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        5⤵
        
        PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36868.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36540.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11435.exe
      4⤵
      PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
      4⤵
      PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
      4⤵
      PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        8⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        8⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        8⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37561.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28480.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32211.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        6⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41069.exe
        6⤵
        
        PID:16004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16004 -s 440
        7⤵
        Program crash
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12589.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        5⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        5⤵
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41476.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18955.exe
        6⤵
        
        PID:15188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43706.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        5⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35772.exe
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34907.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
      4⤵
      PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        5⤵
        
        PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      4⤵
      PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
      4⤵
      PID:5612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        6⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 632
        7⤵
        Program crash
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        6⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
        6⤵
        
        PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        6⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56332.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10840.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5351.exe
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31221.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        5⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        6⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        5⤵
        
        PID:15268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15268 -s 436
        6⤵
        Program crash
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        5⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49125.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40111.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17326.exe
      4⤵
      PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-163.exe
        5⤵
        
        PID:6700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6700 -s 632
        6⤵
        Program crash
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16068.exe
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26122.exe
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      4⤵
      PID:15788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30976.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14309.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
      4⤵
      PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
      4⤵
      PID:15888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11317.exe
    3⤵
    PID:11824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
    3⤵
    PID:14076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
    3⤵
    PID:8076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1683.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63842.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        9⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
        10⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        10⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
        9⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        9⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28704.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
        8⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33172.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        8⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        7⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        6⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33692.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        9⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        9⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        8⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32543.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41261.exe
        8⤵
        
        PID:16160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16160 -s 464
        9⤵
        Program crash
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48537.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57187.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        6⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64854.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49369.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        7⤵
        
        PID:14624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14624 -s 452
        8⤵
        Program crash
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        7⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        7⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31389.exe
        7⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        7⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8118.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:16740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        6⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18678.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9444.exe
        7⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11111.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14970.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41403.exe
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        7⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45677.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20982.exe
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5648.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58320.exe
        6⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        6⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27533.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        7⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7786.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        7⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15195.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        6⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        7⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        7⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3824.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2071.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32787.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45584.exe
        6⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        6⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        5⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39262.exe
        7⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37125.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        6⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        5⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38342.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35449.exe
        6⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
        6⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26051.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35702.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        6⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        5⤵
        
        PID:15588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15588 -s 436
        6⤵
        Program crash
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        5⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        5⤵
        
        PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32655.exe
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
      4⤵
      PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63022.exe
      4⤵
      PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        6⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58196.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
        8⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        8⤵
        
        PID:17012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        8⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44376.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        6⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-285.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7241.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37116.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11171.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21304.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
        7⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-307.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40773.exe
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        5⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        6⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56413.exe
        5⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21666.exe
        5⤵
        
        PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        5⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17600.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54797.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15274.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        6⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14487.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        6⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        5⤵
        
        PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25482.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
      4⤵
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8689.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        6⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14332 -s 464
        7⤵
        Program crash
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        6⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        6⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42990.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9078.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        5⤵
        
        PID:15140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30044.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21503.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        5⤵
        
        PID:5972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 424
        6⤵
        Program crash
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        5⤵
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43890.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7941.exe
      4⤵
      PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57846.exe
      4⤵
      PID:17228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20890.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48627.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59117.exe
        7⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30432.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        6⤵
        
        PID:14752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14752 -s 464
        7⤵
        Program crash
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        6⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
        6⤵
        
        PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
        5⤵
        
        PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35834.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
        6⤵
        
        PID:15908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15908 -s 472
        7⤵
        Program crash
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52544.exe
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39041.exe
        5⤵
        
        PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57686.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        5⤵
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
      4⤵
      PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5542.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10143.exe
      4⤵
      PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3128.exe
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36992.exe
      4⤵
      PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
      4⤵
      PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        5⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        6⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42492.exe
        5⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23337.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
        5⤵
        
        PID:14984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16732.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        5⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48436.exe
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40273.exe
      4⤵
      PID:13600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9379.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59701.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5551.exe
        5⤵
        
        PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60391.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
      4⤵
      PID:11988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
      4⤵
      PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
    3⤵
    PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
      4⤵
      PID:17260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52012.exe
    3⤵
    PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
    3⤵
    PID:11548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
    3⤵
    PID:14652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14652 -s 456
      4⤵
      Program crash
      PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22421.exe
    3⤵
    PID:13896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36816.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10853.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60900.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        8⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        8⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63270.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        6⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 484
        7⤵
        Program crash
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14121.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        6⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46224.exe
        6⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47839.exe
        5⤵
        
        PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        6⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7402.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16067.exe
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        
        PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62756.exe
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        5⤵
        
        PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58828.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38225.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
      4⤵
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32317.exe
      4⤵
      PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
      4⤵
      PID:13580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42880.exe
      4⤵
      PID:13748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11569.exe
        7⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        7⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
        5⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        5⤵
        
        PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22404.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2555.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34305.exe
        6⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52005.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58367.exe
      4⤵
      PID:9484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45504.exe
      4⤵
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
      4⤵
      PID:4852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44382.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60590.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        6⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43042.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56787.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38408.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
        5⤵
        
        PID:15564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15564 -s 472
        6⤵
        Program crash
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        5⤵
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22081.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        5⤵
        
        PID:14080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31113.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
      4⤵
      PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
      4⤵
      PID:15408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
    3⤵
    PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44756.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60557.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51236.exe
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
      4⤵
      PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33671.exe
    3⤵
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
      4⤵
      PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51899.exe
      4⤵
      PID:14392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14392 -s 464
        5⤵
        Program crash
        
        PID:17244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18021.exe
    3⤵
    PID:11676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
    3⤵
    PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
    3⤵
    PID:15116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48793.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34821.exe
        6⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        6⤵
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53401.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1677.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28521.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        5⤵
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54989.exe
        5⤵
        
        PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
      4⤵
      PID:12284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      4⤵
      PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16952.exe
      4⤵
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        5⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
        5⤵
        
        PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61953.exe
      4⤵
      PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25421.exe
        5⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38735.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31505.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16483.exe
      4⤵
      PID:15808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
    3⤵
    PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52389.exe
      4⤵
      PID:12436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36209.exe
    3⤵
    PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15572.exe
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
    3⤵
    PID:7304
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14989.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
        6⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57973.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44062.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        5⤵
        
        PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        5⤵
        
        PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
        5⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63976.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49508.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
      4⤵
      PID:15512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
      4⤵
      PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64826.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22753.exe
      4⤵
      PID:12156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26620.exe
      4⤵
      PID:15748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
      4⤵
      PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37775.exe
      4⤵
      PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
    3⤵
    PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6172.exe
    3⤵
    PID:11816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49780.exe
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
    3⤵
    PID:17096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19904.exe
    3⤵
    PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4247.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57353.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
      4⤵
      PID:1368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
    3⤵
    PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
      4⤵
      PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12393.exe
    3⤵
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39124.exe
    3⤵
    PID:13640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
    3⤵
    PID:6184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
  2⤵
  PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24568.exe
    3⤵
    PID:7376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
    3⤵
    PID:13192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
    3⤵
    PID:15348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
  2⤵
  PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
    3⤵
    PID:6976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
  2⤵
  PID:10708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
  2⤵
  PID:13812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38171.exe
  2⤵
  PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6788 -ip 6788
1⤵
PID:11680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6700 -ip 6700
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 14332 -ip 14332
1⤵
PID:16804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 14128 -ip 14128
1⤵
PID:17000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 14740 -ip 14740
1⤵
PID:17092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 15084 -ip 15084
1⤵
PID:17224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2744 -ip 2744
1⤵
PID:17232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 15060 -ip 15060
1⤵
PID:16416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 14652 -ip 14652
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 15268 -ip 15268
1⤵
PID:16512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 14752 -ip 14752
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 15028 -ip 15028
1⤵
PID:16612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 15384 -ip 15384
1⤵
PID:16640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 14828 -ip 14828
1⤵
PID:16508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4508 -ip 4508
1⤵
PID:16712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 15448 -ip 15448
1⤵
PID:16672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 15392 -ip 15392
1⤵
PID:16780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 15068 -ip 15068
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 15908 -ip 15908
1⤵
PID:17032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 15972 -ip 15972
1⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 16068 -ip 16068
1⤵
PID:7244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 15748 -ip 15748
1⤵
PID:16452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1368 -ip 1368
1⤵
PID:16596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5584 -ip 5584
1⤵
PID:16812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 16160 -ip 16160
1⤵
PID:16868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5916 -ip 5916
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6020 -ip 6020
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5308 -ip 5308
1⤵
PID:17148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5460 -ip 5460
1⤵
PID:15772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1140 -ip 1140
1⤵
PID:15372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4288 -ip 4288
1⤵
PID:16908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5244 -ip 5244
1⤵
PID:7224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6304 -ip 6304
1⤵
PID:6324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6460 -ip 6460
1⤵
PID:16832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5980 -ip 5980
1⤵
PID:15624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 17012 -ip 17012
1⤵
PID:16632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7532 -ip 7532
1⤵
PID:16532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe

Filesize
184KB

MD5
5a660f29414df2254e256cffd3d24cb3

SHA1
e500a213bcd6a47307d3fecb6d9104a9f4d53226

SHA256
ed337082824765ab642ff97d30d439deac9055207511a77b0aa07f3d6ad04b37

SHA512
e2fc678b260549bd07c87e9a9517bbed277310dab9bfe36f529df1ab0c3b4a7d4fd9e212d56936972db8599d3a0c825805c89b908fa9e0ce060778a7725ff8fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe

Filesize
184KB

MD5
105d59de02985c7181ff0444d73161ab

SHA1
22388542af0fd4cd99f333ae97381b25829a26f5

SHA256
6b5241d91d87314f73b6627b8f694d4f2ce3c191f6c58300f68ef6fb8eda81a0

SHA512
b3c0ae7ed13580b9798e0475f026c4cc1516e311cb41946cde978463f99f3cb53f0516e1c2863fda879d220bfeba56451a1f63986696bb8bce8bda794fbaa241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe

Filesize
184KB

MD5
5a91f990e7af432df203571073cc0bea

SHA1
b586e1801ddad27f469036d4c85bdc48679478b6

SHA256
8bc14cfd357262834ab91e6d240b4c29f68cfd8a936e5a721762bd811d66cfa0

SHA512
e5402011fd42eb50cbbeb53142055c7c3e3b2f7aab2892cb6fbcbf9a28260b431bb094de574c7e2c635b0a5f4cfa644d1d7d4fc624cb6742a9df2693752c3922

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20288.exe

Filesize
184KB

MD5
9ff6d225bfe5b73b8eb100ad141d784c

SHA1
ff0e4a3e38cfcd22fd2f63a12ab0af9d6c229277

SHA256
d38bf8a6726de840050fb7c2f730b43190cc05e54c949df6183c0261a9819d5f

SHA512
b30b77dce092c330133c6b06a34c16d14570563136a2762e19020508fa06a1ae1215e31c7e454621500316148fea4d7472d12d80d15c7bfa6aaa6b68a24cf19c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe

Filesize
184KB

MD5
84a394715a68a561c79e2db95096759b

SHA1
3b5b356fcb7d32c46c40fdf1017981136ced54a6

SHA256
912cef5b733888659c23e1faa058224fb0b3ac68fde866b3dc120c68e17714d7

SHA512
fb8e744d78b10163fdb57599f7af7092bb456ba3c8039667aea6c995320c934f692d6686e9bc4205ee0dac6b564c755d3e8688c2f1332297e3f687289eca2571

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21004.exe

Filesize
184KB

MD5
f55d4efc67e875b0461506b4ad1377b5

SHA1
9f9930267ccd7b4bf4391246da6ec969be7ce2b2

SHA256
b297284d0ea147acff8698f4768d7c7dd18d3705087588a796a5594c3facdc0f

SHA512
2336b33d252719ed63b52c4b0465735e63a1d65632050d888d3c5f11a5076456cb90678964ca1650d9655be61dce7b91eec1248412a26b74e0638178de9aacb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23696.exe

Filesize
184KB

MD5
bc55ed607ed205665c8af1f7a58513d1

SHA1
b55e61d9bbdf556be4d106f2aaeae17dd97736e0

SHA256
69b7c2b08084d3e8d987e996909d8374cd42a892a5233f14803b61fa63e9e05d

SHA512
2eb7d4e768d4ff903e3c5994dbb92f3e39630eeebfbab9009ab4b6fb6397ce234b8d99a60b5f46fc4e663b5542fc9cfc74b57feb725b4bd1777488912bbd7584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24076.exe

Filesize
184KB

MD5
084977755bb7f712b88f028e328eb940

SHA1
c9af8505aba7704750683f27563b02caad49b225

SHA256
7404832aae08dc4d92c33315e894fc48c3b9a32ca71a670ae268ec3da26f4e30

SHA512
124ed635531758b02e2784bd06686638b99003141d58555365fb01e0bde58f1ef956e35024338681a5a3d5b6a1e4ce0fcb40294c7bebb71e025445323eb48485

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32824.exe

Filesize
184KB

MD5
14e49d4e017089c929621bcc094956dd

SHA1
c57d49cd20c6f53cafdf0d9b640b260258aa34d0

SHA256
6de087622610f7c49d314cbfbefbbff0ada3f2a59ec25b0777386f35df75b0b4

SHA512
1f0863b19c5866641be869a9c28123ad1b2665408a327b74ac1e5191efd858fc8f6df6fab7752c7ca75ce10eec9507f44847540cda0e3bb046bd27ae613355f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32990.exe

Filesize
184KB

MD5
31ce8f0eedd46258dd1068753a919883

SHA1
a710c727aa70840af51387f4532f8608ff293be7

SHA256
180aa98d2e2f0e93f89fe263ba6f493897716434c4e1d9c82bf319fafeaf16f7

SHA512
d7ca86f2a7a5db8987ef07c4cd45283d4a8bff80202cb0eacd3ba40b3e82e36d92d93f6b3583dde89a5c815109e9ba52f9582734def5d5bc1a6d3b840c68b298

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe

Filesize
184KB

MD5
65efd4426545132ba46025086741d40e

SHA1
8610b132ddc83117160618842f150d77356d4464

SHA256
851211ec713e66d51907985765fcce725b117be144d5250047b1b860838a4571

SHA512
e8264ea654e367954606263a1bfba972186497092d764c5b03c07517a6ac9f77bed8eac8e39a977993c4c38d7f0fb2bf2d1a2f00c66c372ec4bc2074097ab845

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe

Filesize
184KB

MD5
b2dfc547d246d1a17820c6caf801c299

SHA1
dfe2d0c49c0c1bb6ceeee774ad27d7593159c032

SHA256
6a5fe06fe3c43c2fff07feb8278ba4f2b8c0bc7cafe3c2ab4dcb06e60fe25651

SHA512
c4d18d870eba528c3dbdf0c0caee84321fd16ebf3693e547759201624087257797faab00a7b528cc4ae8d4de07f82ddd48c6b522eb6e82cfae878b4b62c11119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe

Filesize
184KB

MD5
4e0a8e5fd4b65611ac3d21e20e2c8b5e

SHA1
39a6cc8d5ada6a4a6ea23099e29d020097a60f72

SHA256
207f006eaee3b9cf5c5d4ccf8ed4aeb5e1bfa93a7bf97e0f7bbba641aab6783f

SHA512
993f5c8cf5176fb8db23a76c200a6b489252b335b11fd9e649c8e1fe3a24487b9edb4cef90a0e980564f124254d52f357549c6f0e5698212565f138c6e9bf72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37703.exe

Filesize
184KB

MD5
6ca6e47a2128908ddd0efe605339df44

SHA1
9ccdbab3add4a589e7ece948be95a352db2916be

SHA256
e06331e511c7b5f3cf3d12eefb7fa1d62284e8b03e6cc60cd838aabca847fc73

SHA512
822cfdff046b66e612206fc3194cc4dd5c16ac4ef5ed935ea61b3e8eee16f0be35527453f880a4b83783276ea60d2495750fba6320fcd2cc5ef85fa5f2aed06e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe

Filesize
184KB

MD5
5db4c0a33e599a9c758a2ad7bb1813cd

SHA1
53342fabc9fde3d4030ef868daec5cd32461f5f5

SHA256
a687d8b61e4c1b6a0bd612a3718f7f07bbbbd8b3b7facdb1d9f17c8caf5ea82d

SHA512
2a6696c885bf2e8041fa715832db6ec5b385a2457bacae28a0286c0dad5763868f92f0faa96178408f86bec7315be158994a63d2d96d78683374eaa43eff30df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41568.exe

Filesize
184KB

MD5
97d40e117b914cbb1359ffb5f5c8096b

SHA1
03379ad8806803c6628538a9f756da90a60a8c1f

SHA256
79bb74f6d959a1b97c45439f6d2ee231e96d38825872aecf4d603c3880db616b

SHA512
b7cb9fd4cce1ecd959db08c8c00e446f4184ac8b44c27774c3b0b52ea04f439cb798ac576dae4d960bba0eb3ad8fabe81a390f35be15b430e5f8854c26ffe04e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42285.exe

Filesize
184KB

MD5
57678888126edb1e338f08ddfa12d16a

SHA1
be4ad8a609c8d2f0b89e56acfe650c3ed158df33

SHA256
77490a6e2c69cf3ac1dcdc9f5aa061437f3c41c09c631881afbec986316cc9f1

SHA512
9d4207387fd465032398b9cd0986300da47967121a452c3669bfaf6f380308655b0b6735ea1d0eedf38c7483e3a536e6885bbeecdecc6225ca449fcde8766597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe

Filesize
184KB

MD5
be8b3d56a9cb8f0ca08a43d19e2dde75

SHA1
ce91d78e36c08b3e2b0f17f65f0930e413b88239

SHA256
abad22bb0db06b5210ae816d48434a5a6b59b6aa3fd415d78394d3065d0be429

SHA512
62919fe66a878681bead0a432cc79f0bcdcad8bdb4a49884d9d94996e911534648a524e1b248c71dfef9c506aea007d966db964d196477514a69b863a147c79f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45243.exe

Filesize
184KB

MD5
4b7b29b8dc53373b59c528a23850309d

SHA1
411581dac981fc3183f75e4569dd717f214e1b5f

SHA256
efb656a4256fddb142497866f8fcd19977c107587669c799415fcabeb63c02e5

SHA512
1025023544b5cc39ec70b30dae0b22fdfadc4f22c23a24cb4aeaab8378a3b5e9dec6f8f17c32e9315547eab5a40202eb765a41a80f184b340e328313dd17e9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe

Filesize
184KB

MD5
031be3d357f508d2faf6757cb1b5ce56

SHA1
7c9704cf9e935616db6b36580cc352e43b04a00d

SHA256
6c39a2cfd0d7fd94defa396fe45205a711470eb5920eab6e7f6de4697f73f8a3

SHA512
815b2ae2a77c87407cf69603b81ad0126e2d866d98fdb7d28cd69d1431612b9e36a291dac448af8c53866da9fefac1c573a82b33049d9a19e31859cbd7b7d384

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe

Filesize
184KB

MD5
16023907e977af6c4e8a3cdbd44401b9

SHA1
1303354637c8851ec06ec0fe8575d106c346a721

SHA256
fa7ae6018a276347458a0619b6a52da76ab9f4fe33bf9912d3ef78831b07aa69

SHA512
f2acfed34e225124ea83cc13010048d7ff943cae00d8b966c4469042f40df0967d3a8e808b65c27cebbad0a922630f32b260740dea8f2219d554942d6e0352d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe

Filesize
184KB

MD5
66c3a7ad3074b0cda84f9cfa0e897185

SHA1
2147c7c6c903bf70e197810d129ba4b34a9923fc

SHA256
3fa62faff9652204d0e733fe1f1c61df6a3ee1b2316a760267a62ed3e99d34f3

SHA512
e7a09e2c644eef94948c1e6a26b2335d62f4517d242c47253ac085e972dbb3f6d860062bf14590f6c97a54cca39e5469c53174517f1f05bdb774751f4a59d492

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5362.exe

Filesize
184KB

MD5
9c0cdad467c1358635093f7652e6399e

SHA1
987c1419dd20048e2b0181a2929ecb498581520c

SHA256
f398d9fb6f9dd9cd20126d1b5279735da9e7912e5176549d627097cfd802fa21

SHA512
79dcad863417e8f165af9283624420add204784761037dd81374fb112e674a107137579a9efdf4040622b28d52f14ae3600398512399101a8e80d715104dffc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe

Filesize
184KB

MD5
ad977b989f522824579b817e81b97a45

SHA1
685bc6b5d13c22c15643610e1f285a1bf10b9c73

SHA256
ea8d04bb46cf1842023d8770255d97632f11aba96c2926488cac7a590a1912f4

SHA512
b67b98b8861ab0cc5b46258ffe045a33794b238b33e3288d3bd3149cf290af130bab573134c94522f9c3ea46010178044ccb366cb9e53ad80c3dfc9245f1cbb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe

Filesize
184KB

MD5
97728b6cf7f754cb2f4e07e08f1b5242

SHA1
de22425960602486d568894768f434690ff4e07e

SHA256
73709b7dbf6a44019b1ccb723a32cfa212b0cfa0ec7551677f7ca8644c799b27

SHA512
d8f2324133bfe75ea441ce3cd038a467fcab50e86cad4ed1381603d9bfdc6f8b7ecd1cbe2baab09c726feea6e6dbf788cebe2f0fc40df35f7edda589c531bca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56940.exe

Filesize
184KB

MD5
349e8bf11f76ea5f0fe61e524761bccb

SHA1
cba8194404a6451d28cc934bde40d9cb2821f642

SHA256
c97af5a3d9b1aae5384125771f1e259e358f823684c73bfd6b43e821fd341afa

SHA512
f0d156e4e3dc0d5c563f9b302836f59eca25a064d2e9f562c1176cec9618b52692ff680903622c3956c993d681aa6b5131d743153917d4f45bbdb409d12f0597

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe

Filesize
184KB

MD5
e522c3b7a0efbdd8997a2ecfec65a20c

SHA1
6a37cc15da5e28af7e8d94039454e262066795c6

SHA256
735f646ca87252a26e9c68da4fccb7b6f7f45f7cceb2087d7cbf9f9e1f7e75e8

SHA512
e27bff4415386e6c339507cbe687e63d4dde83831458c8a0e3e1be7e33fbca4903d195f4757ad3320cc7fc615abcdda4a0de2ae0b0319a8119cba8f0f87a7895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe

Filesize
184KB

MD5
4e387bfebf01146db7c72cbbe71678a0

SHA1
a4240fcf0bab52d718885eff34c7add2ccca958b

SHA256
15ebed1391cd6c8b2145c4208e9391814084d8e93b1b9a2f12c06f54dc80e70f

SHA512
4b21b0cdb413cf14dafd9d063a9dcd8acbe6f2c5de2fa3f7a2a5ed50688e8d41ad77c19dacffbbc6fce416bf6ce0792b2e9fb9290e7d9f1441ae191c486c94ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe

Filesize
184KB

MD5
f9efda755080e5f183230628255c19dc

SHA1
025a9de613271c048553e9e2ac57bd88112e30be

SHA256
eb38cd796414b28eb8020bb2e1a1a6493aaae2c7af72fc0049e463d13db7670b

SHA512
130fa3e8cb546067c4f51e11d92e5dd69c41ae0e062c62dc5571f1a013b7ea55c9ffdbffedcf8d070e79e212d6dd70a60e6bd55c29cddca8a19a7aef4a656a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe

Filesize
184KB

MD5
94813a15e9fc0f5b5041ce25662630b0

SHA1
47f52dbdd96b915db90bdc9e48c0a53ea34a68f2

SHA256
e21f469f299d2e6e8f61ea3b322f9241079eea1d53a1b624a1628a5de1c363b1

SHA512
757c315dfca8a873b2e068f07f59c874952a694c800ccda840271b70dcc15c01b11a9a910ba841ce474ed5432727d76cdfb1c0681bd864d176a5e3017b0e30f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63572.exe

Filesize
184KB

MD5
344ac95214805f05360419b3d4a9e276

SHA1
7ac1c637ca996c26e75a6e9f8e381e2c65bac469

SHA256
d20955a4f9aee3d206d77cc87a476cc9bef59b08a3945da2e85aa9277c5ea5cf

SHA512
4332b510c499bf345af77c290c7bf840b609929844040fb0cd6daac5cac88e4c53e0296845d28375338f0789e632180a7ce4702560c4ea2c3dd4bc1536d9893b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7718.exe

Filesize
184KB

MD5
018f2c7e7d6f88a266280ab472dcfe66

SHA1
d66efa82faade8ae70f338903368c0dfc837bd91

SHA256
129d0e45bd43301901259147f67117b9f7e1e46ef112cf400e0530807a361bdd

SHA512
f469d497293113552a35a69246dff0390d1d3d71966ec80be8694d5fb5cc4918ec369cbd86c89ee8d8bbcdf9e065a123260b2287b4232fefd25cbeef31f14c02

Download Submit
memory/224-325-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/432-343-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/488-345-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/492-130-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/708-237-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1028-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1108-361-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1184-383-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1192-336-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1208-399-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1356-200-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1412-158-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1436-327-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1452-324-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1488-332-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1540-232-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1576-222-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1596-78-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1600-426-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1612-334-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1628-20-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1644-218-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1672-447-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1724-247-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1800-188-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2032-272-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2288-189-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2312-318-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2328-110-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2356-97-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2492-552-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2560-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2856-427-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2896-269-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2948-374-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2996-273-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3144-290-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3160-252-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3192-142-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3280-428-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3372-380-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3380-7-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3432-263-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3624-344-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3644-124-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3688-257-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3692-381-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3740-242-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3836-326-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3840-390-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3884-3912-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3944-32-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3956-98-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3984-77-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3984-3559-0x00007FF838730000-0x00007FF838789000-memory.dmp

Filesize
356KB

Download
memory/4116-44-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4212-199-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4300-117-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4316-13-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4336-333-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4384-99-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4432-151-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4484-425-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4488-411-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4560-323-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4600-335-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4612-551-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4704-166-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4724-159-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4740-400-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4804-190-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4956-310-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5004-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5060-227-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5080-43-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5132-440-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5152-444-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5176-445-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5188-560-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5228-446-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5264-451-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5376-472-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5384-473-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5392-474-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5424-481-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5440-3764-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5536-482-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5552-485-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5568-486-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5716-492-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5756-500-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5780-501-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5832-511-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5856-512-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5900-516-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6004-522-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6048-533-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6072-534-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6096-548-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6184-3422-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6312-3160-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6472-3123-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6640-3134-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6700-3551-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/13580-3893-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14400-3197-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14408-3240-0x0000000074DB0000-0x0000000074DBF000-memory.dmp

Filesize
60KB

Download
memory/14864-3692-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15060-3330-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15072-3464-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15180-3892-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15392-3734-0x00000000757B0000-0x00000000757C8000-memory.dmp

Filesize
96KB

Download
memory/15448-4035-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15500-4071-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/15552-4036-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16068-4072-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16140-3138-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16552-3730-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16660-3159-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/16788-3184-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17136-3776-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/17304-3871-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads