589301f4dcc2502ddb8c3369196f0455285a34e14d46215c3645fc7b8dd82b3d

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4e64080acaa8302ec8c33f8de5a138e.exe
Size

184KB
MD5

b4e64080acaa8302ec8c33f8de5a138e
SHA1

613cb8fd23821caa1a0fe51f98509e55c04e4b69
SHA256

589301f4dcc2502ddb8c3369196f0455285a34e14d46215c3645fc7b8dd82b3d
SHA512

dc48d51ddf0efe1e4fb5f8d458e7a2f6c42e84714ddc083e719230cb45cc3c09deaef713c1ab698d25adf8a2eff09e5a98842e4c2b7fd946515d3811ac5400bd
SSDEEP

3072:KjO7oA1U50AUkBOHpd3RL08bbIFprzQ5TH0px7kt40BlivwFa:KjSohFjBudBL08JxwuBlivwF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2356	Unicorn-43502.exe
2896	Unicorn-63704.exe
2640	Unicorn-47923.exe
2424	Unicorn-22153.exe
2472	Unicorn-22366.exe
3052	Unicorn-22920.exe
1516	Unicorn-63756.exe
684	Unicorn-18256.exe
2676	Unicorn-14726.exe
2324	Unicorn-50373.exe
2372	Unicorn-38675.exe
580	Unicorn-9340.exe
2108	Unicorn-6963.exe
1388	Unicorn-34997.exe
2256	Unicorn-14742.exe
2084	Unicorn-31825.exe
1872	Unicorn-63559.exe
2912	Unicorn-22527.exe
1164	Unicorn-31249.exe
1920	Unicorn-51115.exe
1204	Unicorn-55583.exe
1628	Unicorn-35717.exe
1512	Unicorn-22392.exe
2280	Unicorn-18862.exe
972	Unicorn-58572.exe
1704	Unicorn-43352.exe
1980	Unicorn-23678.exe
2216	Unicorn-43544.exe
2112	Unicorn-47799.exe
2684	Unicorn-6211.exe
2196	Unicorn-26632.exe
2628	Unicorn-47991.exe
2544	Unicorn-63772.exe
2572	Unicorn-9200.exe
1888	Unicorn-25707.exe
2876	Unicorn-45573.exe
680	Unicorn-45765.exe
2712	Unicorn-42833.exe
2736	Unicorn-39303.exe
1732	Unicorn-46341.exe
332	Unicorn-6932.exe
2592	Unicorn-47602.exe
1556	Unicorn-32034.exe
1604	Unicorn-61006.exe
2816	Unicorn-8276.exe
2156	Unicorn-40010.exe
2160	Unicorn-52817.exe
1400	Unicorn-3061.exe
2072	Unicorn-48370.exe
2784	Unicorn-61177.exe
1876	Unicorn-42807.exe
2120	Unicorn-22941.exe
2188	Unicorn-27217.exe
384	Unicorn-63035.exe
596	Unicorn-50975.exe
2972	Unicorn-2734.exe
2796	Unicorn-7373.exe
2500	Unicorn-56211.exe
2116	Unicorn-7565.exe
1548	Unicorn-39683.exe
2596	Unicorn-43767.exe
2992	Unicorn-19433.exe
2768	Unicorn-35215.exe
2516	Unicorn-16273.exe

Loads dropped DLL 64 IoCs

pid	Process
1984	b4e64080acaa8302ec8c33f8de5a138e.exe
1984	b4e64080acaa8302ec8c33f8de5a138e.exe
2356	Unicorn-43502.exe
2356	Unicorn-43502.exe
1984	b4e64080acaa8302ec8c33f8de5a138e.exe
1984	b4e64080acaa8302ec8c33f8de5a138e.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2600	WerFault.exe
2640	Unicorn-47923.exe
2640	Unicorn-47923.exe
2424	Unicorn-22153.exe
2424	Unicorn-22153.exe
2640	Unicorn-47923.exe
2640	Unicorn-47923.exe
3052	Unicorn-22920.exe
3052	Unicorn-22920.exe
2472	Unicorn-22366.exe
2472	Unicorn-22366.exe
2424	Unicorn-22153.exe
2424	Unicorn-22153.exe
1516	Unicorn-63756.exe
3052	Unicorn-22920.exe
1516	Unicorn-63756.exe
3052	Unicorn-22920.exe
684	Unicorn-18256.exe
684	Unicorn-18256.exe
2472	Unicorn-22366.exe
2472	Unicorn-22366.exe
2676	Unicorn-14726.exe
2676	Unicorn-14726.exe
2324	Unicorn-50373.exe
2324	Unicorn-50373.exe
1516	Unicorn-63756.exe
1516	Unicorn-63756.exe
2372	Unicorn-38675.exe
2372	Unicorn-38675.exe
580	Unicorn-9340.exe
580	Unicorn-9340.exe
684	Unicorn-18256.exe
684	Unicorn-18256.exe
1388	Unicorn-34997.exe
1388	Unicorn-34997.exe
2676	Unicorn-14726.exe
2676	Unicorn-14726.exe
2108	Unicorn-6963.exe
2108	Unicorn-6963.exe
2256	Unicorn-14742.exe
2256	Unicorn-14742.exe
2324	Unicorn-50373.exe
2324	Unicorn-50373.exe
2084	Unicorn-31825.exe
2084	Unicorn-31825.exe
2912	Unicorn-22527.exe
2912	Unicorn-22527.exe
580	Unicorn-9340.exe
1920	Unicorn-51115.exe
580	Unicorn-9340.exe
1920	Unicorn-51115.exe
1388	Unicorn-34997.exe
1388	Unicorn-34997.exe
1872	Unicorn-63559.exe

Program crash 40 IoCs

pid	pid_target	Process	procid_target
2600	2896	WerFault.exe	29
2548	2108	WerFault.exe	41
2644	1164	WerFault.exe	47
2384	2084	WerFault.exe	44
2940	2876	WerFault.exe	66
2772	2188	WerFault.exe	85
840	596	WerFault.exe	87
760	1876	WerFault.exe	83
984	2992	WerFault.exe	94
976	2052	WerFault.exe	107
2580	796	WerFault.exe	105
2448	2788	WerFault.exe	126
2328	1848	WerFault.exe	122
108	2204	WerFault.exe	128
1940	2812	WerFault.exe	148
2472	2208	WerFault.exe	152
2224	1712	WerFault.exe	149
1108	2252	WerFault.exe	146
1240	1936	WerFault.exe	158
2568	604	WerFault.exe	183
2764	1840	WerFault.exe	197
3028	2868	WerFault.exe	211
2836	2528	WerFault.exe	212
1980	1348	WerFault.exe	209
2820	2784	WerFault.exe	226
2932	2900	WerFault.exe	233
2116	876	WerFault.exe	247
1972	2736	WerFault.exe	252
1916	972	WerFault.exe	263
2760	2112	WerFault.exe	275
1448	2968	WerFault.exe	308
1504	2100	WerFault.exe	327
2184	1728	WerFault.exe	325
852	2632	WerFault.exe	332
616	2656	WerFault.exe	321
3240	2296	WerFault.exe	357
3448	2492	WerFault.exe	351
3824	2240	WerFault.exe	358
3808	3524	WerFault.exe	377
3872	3152	WerFault.exe	390

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1984	b4e64080acaa8302ec8c33f8de5a138e.exe
2356	Unicorn-43502.exe
2640	Unicorn-47923.exe
2896	Unicorn-63704.exe
2424	Unicorn-22153.exe
3052	Unicorn-22920.exe
2472	Unicorn-22366.exe
2676	Unicorn-14726.exe
1516	Unicorn-63756.exe
684	Unicorn-18256.exe
2324	Unicorn-50373.exe
2372	Unicorn-38675.exe
580	Unicorn-9340.exe
1388	Unicorn-34997.exe
2108	Unicorn-6963.exe
2256	Unicorn-14742.exe
2084	Unicorn-31825.exe
1872	Unicorn-63559.exe
2912	Unicorn-22527.exe
1920	Unicorn-51115.exe
1164	Unicorn-31249.exe
1628	Unicorn-35717.exe
1204	Unicorn-55583.exe
1512	Unicorn-22392.exe
2280	Unicorn-18862.exe
972	Unicorn-58572.exe
1704	Unicorn-43352.exe
2216	Unicorn-43544.exe
1980	Unicorn-23678.exe
2112	Unicorn-47799.exe
2684	Unicorn-6211.exe
2196	Unicorn-26632.exe
2544	Unicorn-63772.exe
2628	Unicorn-47991.exe
2572	Unicorn-9200.exe
2876	Unicorn-45573.exe
1888	Unicorn-25707.exe
680	Unicorn-45765.exe
2712	Unicorn-42833.exe
2736	Unicorn-39303.exe
1732	Unicorn-46341.exe
2592	Unicorn-47602.exe
332	Unicorn-6932.exe
1556	Unicorn-32034.exe
1604	Unicorn-61006.exe
2816	Unicorn-8276.exe
2156	Unicorn-40010.exe
2072	Unicorn-48370.exe
2160	Unicorn-52817.exe
1400	Unicorn-3061.exe
2784	Unicorn-61177.exe
2188	Unicorn-27217.exe
384	Unicorn-63035.exe
2120	Unicorn-22941.exe
1876	Unicorn-42807.exe
596	Unicorn-50975.exe
2796	Unicorn-7373.exe
2972	Unicorn-2734.exe
2500	Unicorn-56211.exe
2116	Unicorn-7565.exe
1548	Unicorn-39683.exe
2596	Unicorn-43767.exe
2992	Unicorn-19433.exe
2516	Unicorn-16273.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2356	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	28
PID 1984 wrote to memory of 2356	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	28
PID 1984 wrote to memory of 2356	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	28
PID 1984 wrote to memory of 2356	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	28
PID 2356 wrote to memory of 2896	2356	Unicorn-43502.exe	29
PID 2356 wrote to memory of 2896	2356	Unicorn-43502.exe	29
PID 2356 wrote to memory of 2896	2356	Unicorn-43502.exe	29
PID 2356 wrote to memory of 2896	2356	Unicorn-43502.exe	29
PID 1984 wrote to memory of 2640	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	30
PID 1984 wrote to memory of 2640	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	30
PID 1984 wrote to memory of 2640	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	30
PID 1984 wrote to memory of 2640	1984	b4e64080acaa8302ec8c33f8de5a138e.exe	30
PID 2896 wrote to memory of 2600	2896	Unicorn-63704.exe	31
PID 2896 wrote to memory of 2600	2896	Unicorn-63704.exe	31
PID 2896 wrote to memory of 2600	2896	Unicorn-63704.exe	31
PID 2896 wrote to memory of 2600	2896	Unicorn-63704.exe	31
PID 2640 wrote to memory of 2424	2640	Unicorn-47923.exe	32
PID 2640 wrote to memory of 2424	2640	Unicorn-47923.exe	32
PID 2640 wrote to memory of 2424	2640	Unicorn-47923.exe	32
PID 2640 wrote to memory of 2424	2640	Unicorn-47923.exe	32
PID 2424 wrote to memory of 2472	2424	Unicorn-22153.exe	33
PID 2424 wrote to memory of 2472	2424	Unicorn-22153.exe	33
PID 2424 wrote to memory of 2472	2424	Unicorn-22153.exe	33
PID 2424 wrote to memory of 2472	2424	Unicorn-22153.exe	33
PID 2640 wrote to memory of 3052	2640	Unicorn-47923.exe	34
PID 2640 wrote to memory of 3052	2640	Unicorn-47923.exe	34
PID 2640 wrote to memory of 3052	2640	Unicorn-47923.exe	34
PID 2640 wrote to memory of 3052	2640	Unicorn-47923.exe	34
PID 3052 wrote to memory of 1516	3052	Unicorn-22920.exe	35
PID 3052 wrote to memory of 1516	3052	Unicorn-22920.exe	35
PID 3052 wrote to memory of 1516	3052	Unicorn-22920.exe	35
PID 3052 wrote to memory of 1516	3052	Unicorn-22920.exe	35
PID 2472 wrote to memory of 684	2472	Unicorn-22366.exe	36
PID 2472 wrote to memory of 684	2472	Unicorn-22366.exe	36
PID 2472 wrote to memory of 684	2472	Unicorn-22366.exe	36
PID 2472 wrote to memory of 684	2472	Unicorn-22366.exe	36
PID 2424 wrote to memory of 2676	2424	Unicorn-22153.exe	37
PID 2424 wrote to memory of 2676	2424	Unicorn-22153.exe	37
PID 2424 wrote to memory of 2676	2424	Unicorn-22153.exe	37
PID 2424 wrote to memory of 2676	2424	Unicorn-22153.exe	37
PID 1516 wrote to memory of 2324	1516	Unicorn-63756.exe	38
PID 1516 wrote to memory of 2324	1516	Unicorn-63756.exe	38
PID 1516 wrote to memory of 2324	1516	Unicorn-63756.exe	38
PID 1516 wrote to memory of 2324	1516	Unicorn-63756.exe	38
PID 3052 wrote to memory of 2372	3052	Unicorn-22920.exe	39
PID 3052 wrote to memory of 2372	3052	Unicorn-22920.exe	39
PID 3052 wrote to memory of 2372	3052	Unicorn-22920.exe	39
PID 3052 wrote to memory of 2372	3052	Unicorn-22920.exe	39
PID 684 wrote to memory of 580	684	Unicorn-18256.exe	40
PID 684 wrote to memory of 580	684	Unicorn-18256.exe	40
PID 684 wrote to memory of 580	684	Unicorn-18256.exe	40
PID 684 wrote to memory of 580	684	Unicorn-18256.exe	40
PID 2472 wrote to memory of 2108	2472	Unicorn-22366.exe	41
PID 2472 wrote to memory of 2108	2472	Unicorn-22366.exe	41
PID 2472 wrote to memory of 2108	2472	Unicorn-22366.exe	41
PID 2472 wrote to memory of 2108	2472	Unicorn-22366.exe	41
PID 2676 wrote to memory of 1388	2676	Unicorn-14726.exe	42
PID 2676 wrote to memory of 1388	2676	Unicorn-14726.exe	42
PID 2676 wrote to memory of 1388	2676	Unicorn-14726.exe	42
PID 2676 wrote to memory of 1388	2676	Unicorn-14726.exe	42
PID 2324 wrote to memory of 2256	2324	Unicorn-50373.exe	43
PID 2324 wrote to memory of 2256	2324	Unicorn-50373.exe	43
PID 2324 wrote to memory of 2256	2324	Unicorn-50373.exe	43
PID 2324 wrote to memory of 2256	2324	Unicorn-50373.exe	43

C:\Users\Admin\AppData\Local\Temp\b4e64080acaa8302ec8c33f8de5a138e.exe
"C:\Users\Admin\AppData\Local\Temp\b4e64080acaa8302ec8c33f8de5a138e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 200
      4⤵
      Loads dropped DLL
      Program crash
      PID:2600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43352.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56211.exe
        10⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26466.exe
        11⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        12⤵
        
        PID:800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        13⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12597.exe
        14⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
        15⤵
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        16⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        17⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        18⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36942.exe
        19⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        20⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        21⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 220
        22⤵
        Program crash
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        21⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        22⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        23⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63006.exe
        22⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        23⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53449.exe
        18⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        19⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10442.exe
        20⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        21⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        22⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 240
        23⤵
        Program crash
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43596.exe
        10⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        11⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4844.exe
        12⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27398.exe
        13⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33148.exe
        14⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        15⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        16⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29552.exe
        17⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        18⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
        19⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46732.exe
        20⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        21⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
        22⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
        23⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10817.exe
        14⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51586.exe
        15⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 244
        16⤵
        Program crash
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        13⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        14⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51202.exe
        15⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        16⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9038.exe
        17⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        18⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        19⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
        20⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        21⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        22⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        17⤵
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
        18⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        19⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        20⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        21⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        10⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 224
        11⤵
        Program crash
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 240
        10⤵
        Program crash
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23678.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32034.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        9⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        10⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        11⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 224
        12⤵
        Program crash
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        8⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        9⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
        10⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        11⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        12⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15005.exe
        13⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 224
        14⤵
        Program crash
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        13⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51477.exe
        14⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
        15⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        16⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        17⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        18⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exe
        19⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        20⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 240
        21⤵
        Program crash
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        18⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        19⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13909.exe
        20⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        11⤵
        
        PID:604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 604 -s 240
        12⤵
        Program crash
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31249.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 244
        7⤵
        Program crash
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55583.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        9⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34847.exe
        10⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        11⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
        12⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        13⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        14⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52354.exe
        15⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
        16⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36283.exe
        17⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        18⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        19⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
        20⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        21⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        12⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34658.exe
        13⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41560.exe
        14⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 224
        15⤵
        Program crash
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
        8⤵
        
        PID:796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 220
        9⤵
        Program crash
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61177.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        8⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        9⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
        10⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 220
        11⤵
        Program crash
        
        PID:2224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 236
        6⤵
        Program crash
        
        PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46341.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        10⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        11⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        12⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        13⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        14⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 220
        15⤵
        Program crash
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17994.exe
        14⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11871.exe
        15⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        16⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        17⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        18⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63696.exe
        19⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19945.exe
        20⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2809.exe
        21⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        9⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41344.exe
        10⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49577.exe
        11⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        12⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        13⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        14⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
        15⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        16⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35468.exe
        17⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10787.exe
        18⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        19⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
        20⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
        21⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        22⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        15⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36667.exe
        16⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        17⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 240
        18⤵
        Program crash
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5343.exe
        17⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26172.exe
        18⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31704.exe
        19⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
        20⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27672.exe
        21⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        19⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44200.exe
        20⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47657.exe
        13⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        14⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
        15⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3418.exe
        16⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63880.exe
        17⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        18⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64578.exe
        19⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1475.exe
        20⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 224
        21⤵
        Program crash
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        12⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        13⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        14⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2712.exe
        15⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        16⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        17⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 240
        18⤵
        Program crash
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19433.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 244
        9⤵
        Program crash
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6932.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39683.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        9⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        10⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
        11⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28742.exe
        12⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        13⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        14⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11980.exe
        15⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        16⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64679.exe
        17⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8597.exe
        18⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        19⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        20⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        21⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35215.exe
        8⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17359.exe
        9⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32966.exe
        10⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39842.exe
        11⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        12⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12120.exe
        13⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        14⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
        15⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        16⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        17⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24314.exe
        18⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        19⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        20⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57792.exe
        12⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        13⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        14⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 240
        15⤵
        Program crash
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        8⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28882.exe
        9⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        10⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28680.exe
        11⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48685.exe
        12⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55753.exe
        13⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38426.exe
        14⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        15⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        16⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3426.exe
        17⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42207.exe
        18⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        19⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52010.exe
        20⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 244
        21⤵
        Program crash
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        20⤵
        
        PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35717.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61006.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46528.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
        9⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        10⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 224
        11⤵
        Program crash
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        7⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
        8⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54621.exe
        9⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        10⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        11⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        12⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        13⤵
        
        PID:876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 224
        14⤵
        Program crash
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48482.exe
        9⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        10⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10646.exe
        11⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38410.exe
        12⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7787.exe
        13⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16740.exe
        14⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        15⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        16⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25487.exe
        17⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 240
        18⤵
        Program crash
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3874.exe
        12⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 240
        13⤵
        Program crash
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60594.exe
        10⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32541.exe
        11⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2551.exe
        12⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51721.exe
        13⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        14⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
        15⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 240
        16⤵
        Program crash
        
        PID:616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22392.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9200.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42807.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 240
        10⤵
        Program crash
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 220
        9⤵
        Program crash
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25707.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63035.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        9⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 240
        10⤵
        Program crash
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        10⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44777.exe
        11⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35810.exe
        12⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 244
        13⤵
        Program crash
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 244
        8⤵
        Program crash
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
        8⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        9⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49878.exe
        10⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60371.exe
        11⤵
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49100.exe
        12⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
        13⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        14⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        15⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        16⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54129.exe
        17⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        18⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        19⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9259.exe
        20⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44257.exe
        21⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49052.exe
        22⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        14⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
        15⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10595.exe
        16⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13566.exe
        17⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43167.exe
        18⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11008.exe
        19⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        20⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
        21⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3395.exe
        18⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31289.exe
        19⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45765.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2734.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
        9⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57387.exe
        10⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 220
        11⤵
        Program crash
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        8⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23947.exe
        9⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        10⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42852.exe
        11⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 240
        12⤵
        Program crash
        
        PID:2764
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 248
        6⤵
        Program crash
        
        PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18682.exe
        8⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33560.exe
        9⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        10⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 240
        11⤵
        Program crash
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        9⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
        10⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        11⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        12⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14829.exe
        13⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        14⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        15⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        16⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        17⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 240
        18⤵
        Program crash
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5026.exe
        13⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47912.exe
        14⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56755.exe
        15⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48050.exe
        16⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        17⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57635.exe
        18⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
        17⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
        18⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51757.exe
        12⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28867.exe
        13⤵
        
        PID:972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 224
        14⤵
        Program crash
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30571.exe
        8⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 244
        9⤵
        Program crash
        
        PID:108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59164.exe
        7⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 240
        8⤵
        Program crash
        
        PID:976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-22941.exe

Filesize
184KB

MD5
1f270bcd6e60172c6c91d69fc0f8aa7f

SHA1
0d6b2f29b6ef589b8c759f28ae7b15859b3613ce

SHA256
a38540a819564fc957867c865abffcc103e7e8d8cfc966268d87343dc926d544

SHA512
0acf3561e1cf5f8a6dcb08168f15f99d06cd3552887940b741e13678ba4976bf82f6930d4d819622df1a049af3aee95fc2879017cec4fa2dd5f19283b69d9cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe

Filesize
184KB

MD5
5163c831255e7729d5e260dcdf40d4c3

SHA1
f0f0f953d86804736893c5c30f2f395eb3aeee47

SHA256
2796b457715f94c4141498cf3c8c2358897b92576879adf855f0349d27c9af4c

SHA512
073e167b13feaa926b0695625a1c2a3b2ed0bee83b67e456344c7ade551b756687c74d9781e8b588f5ae19e8a603c376ff10174959e11bdb314a9e4f282555aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe

Filesize
184KB

MD5
1ea32be6ec0e176e82bce4e543b49801

SHA1
5e213e945f9685fdee139e5144c7514589cc908f

SHA256
d8f15f19200040f1fa5d12f3572fd205ea01e21830263260b8f89267c6a550fa

SHA512
dd6eb6a5952152e1a25d1c518fee3d988166b65c889ca15fed70660dedd19f4df9ee3d48c6f73fb530ad9c4542ee74d1305eb9725589af5b2af102713c9369f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe

Filesize
184KB

MD5
1e1fc3bd74e4858e8c2105270bee2e27

SHA1
e0c967e7a0fddcf9df28cec57e0fad3aab2a19a8

SHA256
024d30fb181ae4378868fe54ecd1db8bc40041efbb67e2bc6c305cded97a53e5

SHA512
82c68f6f8f50b9bb5f4be39faae71027c611a12acbb95cfc118daa5bab48312c69cc193d0b6514cfacb68f3492d671a7b87666a838b4e0cc87b2dba62c9359f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe

Filesize
184KB

MD5
10e7912cf55bc9f06e6ab3fcab9f2263

SHA1
c24c315fa64628116222f37cceb1de8a403d5b61

SHA256
8324eb66e122c5e8b96b0e3d75d59ec0db33b8d251828d85c20cb9d955b56040

SHA512
03e1cebbb8304a14de66fcf2011e06a3e6c5ac875a9ffcbba696311fd73238f0468cbfafbc3b5c22ae15a89f68641f367d2f148912f1804071b51621a604fdd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe

Filesize
184KB

MD5
5d3d7c5d57ccc87d7e8b4dfc0e342ace

SHA1
93be5c1ce5274ecfb465d8d4a90a9baab66bba9a

SHA256
12291fda1772f64ac0c45bb12b2f9dd8d446f3701aa86215a774d52898ee3085

SHA512
e3eb1c058cc0f57f361567b1b1998a939493d40b7618a212aa1a29104602e6b5953613323667b114fa4a36cd478e7409d90e8ebd56d83f2fa887ca44251dcc8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6211.exe

Filesize
184KB

MD5
a4a81fdb16c6e4002ae0429207e80a7d

SHA1
96b6e53f51df8c4677de4d6d84a3c5f18643b291

SHA256
7c183a918c6ad212c2b902aa968f49c1fde710ede18a67d8ad73ec3396d9692b

SHA512
dadbf4c7520337a1cb99394e84b701b51c087da7261ec0ea3075ce857b92db737f43de90fec233e45f4fc5bc545f74bd67fb5fa355df1f4357f7faac157f51af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe

Filesize
184KB

MD5
efec27a5f2ecd632b071888fa7309bc3

SHA1
48b8192ff7a06628fcad33b347198056a9a04e90

SHA256
61fd6c3c90509034ffca128d06dfc76130b2101cff776f0fe2c0118bd0c141ff

SHA512
eeb3d7cc592b3766d5ed3a8055fb5c4b00d67dedc3739bbb86ada17b4eebe38dec40bc9996cfe5bad390efd431d424965aa3807501b5536e6541521a3fa06c57

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe

Filesize
184KB

MD5
6bfacf6c03787538ce492321100c2f6d

SHA1
bfe2a95884512d25e64d38a2a0d6ded5557c19a8

SHA256
640061254192348dbba1263731b214d51f43ba82b8722911f66b2436b525bdb5

SHA512
5cc1ae81831d89d0d28b0f0865bc48aa82983e18d2610f526ee605e7e2a4ca7b280a71afd92c666c7eec8808e5c58fe5e89dca2e6ab39d2e191a45faea066ede

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14742.exe

Filesize
184KB

MD5
aa8f23b71c4d1aeb0c582fdc9d927ed7

SHA1
957259201890f16cdc1e899cde11a0a04e66897b

SHA256
9cbc859962bec08cd8335aacbede3122615fc1403b4b03d36f123607334e8986

SHA512
f1da549b05f093fd2f6773a3166ea7804112b13cef13d374a2e6d79e7f0046a45e44c298ee271a00f47fed63eacfa7980c7f7de0c20c8bd73a4af01909948bdc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18256.exe

Filesize
184KB

MD5
2b2e146afc3d5f30413f9aaadc1aeda8

SHA1
8056e8dd22b2a1d3f389e5517b1fba904980c5ea

SHA256
8c069034f90fe7813668f1de01baa2c0c54d8be48553dd31c5b7b90fca81e88f

SHA512
a04be405bfc84c5b8c3f067e0deaf9c6445e4b865a6b7079ffc365a5a310b38ca26f48e33ffc2d3f43e98b60025cd2bf71561885473ae5af28d06f5220aed674

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22153.exe

Filesize
184KB

MD5
f81017aec80d72b5f60a442adf88ca1f

SHA1
782818c359aad08f4504d3fd25f16f8561856843

SHA256
10bd2f9cbe2f68114e516d92f90c836c13ef4f7a29a1a1cc6d2163b07effe19b

SHA512
07fa469871174c36b8662a3e97fbac2eeefba19b941d45bc62cf26073d146f6d946740ff249f498388c7d96dee1587e95ee63c3de86b651d60b9b9c933093b22

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe

Filesize
184KB

MD5
397c384b784558529be84da3dee5efbc

SHA1
e44c19a49bde3adf0da21ad2fd57e05378c1646a

SHA256
c1ff6bd8e10fc9059261d6b30370d1c455d7e394ebbec263f93aef771adc4cc1

SHA512
8dc87c743755af59b9ae085a6d08c97db133af0bf2ac9920985d871483f103953d17f1dba1dd701a987203524b44a17079bf55f4503cfb669ca846d92472084a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe

Filesize
184KB

MD5
49fe8dc38a0eebdb62e93b33310fe89a

SHA1
00dd00eac0f403041cb8f5fb35fb742e411f4e92

SHA256
af9f03c0cf2b1a90f6b7ef7da55f86d05d78a102b0a6733935c5442ecc35a968

SHA512
e1ace1d91455c11fb27db3a40f1b4bcbfc0c28411ce01cfca54b96e9a47e26c8c03aa82e998db1af6c2cba4684a747d882c7c887e781c26b227ce70fcdea3227

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe

Filesize
184KB

MD5
16559cf5a74b44e95988a52da190c5fc

SHA1
c4848fdd154c4767e37c2bb0c3ad85171b9205c0

SHA256
cf7c881c9d438afc914554e9aea6a1bb5fd48577d2e96155c99a34a58f4a4ba2

SHA512
df1db23afd39e2b23d576a1b1113b983df42d7af2cda6af9bbfececa525f3a46e02da264ed1ad20033ba84a09f62505916bdaaa42b4ab0c8223c21628fbeea0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe

Filesize
184KB

MD5
569aeae07981f3eb6d2e0833ec19a138

SHA1
85173fa1f843611345875022eae09f34b4906964

SHA256
ddfa690ccca4c248db0419642c7647fcc1809d32c28e5f4a51f02101d744bbb6

SHA512
3853ae51dde48e1bd0b124ea4575a87afbbd3f2d4b5761da18a4807b0991ada252ebfc540c79dc08cd4235523495ac2d7eeb0b859784f2aab754e77d0d1984f1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-43502.exe

Filesize
184KB

MD5
6c32ea25ebcfdbfbd4bd497b8afe65f2

SHA1
0dc469a9d0304ccb2301c5fa90fbb283f25f1af9

SHA256
1d3204045befc076a56e5bd2e68cda4df98379f8ad3b384ba31c62c551e24c48

SHA512
eb6825b7488d0e69ea1ed779ace394bb78946ee0e9bc7745fcc8ecc455e54165a4a792f587eb996fd3fd5cfdb4d598e74369e23ed3e05ea1d64de153a69af9ca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47923.exe

Filesize
184KB

MD5
29314de02777ab08951939b35f669d24

SHA1
984e9c93f0ccdc6b9c659c36fcf1f80ed0a4e9c2

SHA256
83dc433ed54cf8b22c8d5c7c24320d2b480d3136327cd3653922b1d02110d27c

SHA512
a87661602223c5a539b7963d1dbe74be9d62c9dab600ba8bf4b30aebd1e7ac62eba44a99ee5c818275b4a80a28c5ee9a3371fbb42c4d2628490feb3790de148c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50373.exe

Filesize
184KB

MD5
3109d13aee0cf34f5d9a4619116b83c2

SHA1
13840ee8302512d9202c624957aee2b3ca48a892

SHA256
c8a0fa19330b27e41121ba48a68b05ad9a06bfad431a096c6d2fac84a8658e31

SHA512
4123d2d13a626bd23ed26ce191fede48a3577ae7e75bc3b4bbd2678e9949a8870b53c445a4a05711df9d9f092a6b9ce3fc7b92e2ef2888cc238977d865f7645e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63559.exe

Filesize
184KB

MD5
455e047a7bce0e356f4bc3e482d12ed2

SHA1
c171f09f485cfcb1c94df7d48961bdaf91c7c6eb

SHA256
ff0f114380c40edc516dcbf8f52e5c605c63fe17cbb8af839580a2d346641874

SHA512
2009ed5aad51885da17d19860bf06c21c4414602f7b1ecdadf1d1992fb2366b5450d7daa8835cc89e89f96d3936b3513c34b8c4a856b4680aac614157ce90753

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe

Filesize
184KB

MD5
65e7c5e01733a2327d5eba7c79ead457

SHA1
0d959631adeecdf29343e6c1e5b55fb1b1a3723d

SHA256
72bf2a5b19b092204a9b8cbb789b9f30f4de2068e854344c11043f9be8253695

SHA512
3779ad59fd0bfffe17b80e9a8623c50f0caf1d11edda8be813565aabf5f7f025e59e340a4659e5f14519666c739e391dc7e39835d3123460a096e61de5239f86

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe

Filesize
184KB

MD5
e38eaa675b940bb26dd7df0cd5f410e7

SHA1
911e27fba0f3161a9f95143f559fe3cf71abed19

SHA256
c4551f2b02eb8f4d075ac39e664875432011a364493306cfd78a359d07d249c3

SHA512
d04a5745a2e11469a4f3dbe6c3238a9ef345b865c33b1a4baf6964d1194f2215d202670acc3e1fd667d064ecc75a1348b0f7e6d63ff02c1da01796d9b5780133

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe

Filesize
184KB

MD5
f022b105f08a0258df47f659acb5ce9b

SHA1
1316fa2d0f9918947bccc9a283cf9bd61bae1af3

SHA256
0209def9c37ea1e73837ae0bf71f224c0ddf3471a0ed158f65bda31f4c3d8d92

SHA512
f1d8cec1a51e4d79a2f60540894eb9d157bf5980a6302f410d15902fde3bdddd3246b6694a8ed6799a6226656a6640db9e4ee0e7871dc33efe1fb72c1c9cf202

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads