943d7aec3fd795e1882dba77e0715382c43e779d91bc4690930b23645a879e9f

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded2dae5fb60b3025b14d5bca874eb94.exe
Size

184KB
MD5

ded2dae5fb60b3025b14d5bca874eb94
SHA1

e694ef025b47679e979783670e4f14e4f79a70d5
SHA256

943d7aec3fd795e1882dba77e0715382c43e779d91bc4690930b23645a879e9f
SHA512

fe21cb3d4286486650fecc36c0d54fe0248477fcbf024d01bb894d989840c0783f1b3231dbd97f50d5222c852e9867a21d2120a1e7a594b367999069bdc44c5a
SSDEEP

3072:leHpocgAOA0bOjjMTRc4zFbObV6j/YIcDQx82Py17lPdpFW:leJo2D0bIMNc4zNlkB7lPdpF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1900	Unicorn-8020.exe
960	Unicorn-41015.exe
1880	Unicorn-50807.exe
2608	Unicorn-58586.exe
1164	Unicorn-46889.exe
2868	Unicorn-62670.exe
2516	Unicorn-63905.exe
2148	Unicorn-60376.exe
2404	Unicorn-26957.exe
1968	Unicorn-31041.exe
1980	Unicorn-31595.exe
2864	Unicorn-65104.exe
1952	Unicorn-49323.exe
1432	Unicorn-48576.exe
3024	Unicorn-57211.exe
1808	Unicorn-61295.exe
2224	Unicorn-49598.exe
772	Unicorn-24347.exe
2552	Unicorn-12649.exe
2312	Unicorn-53018.exe
2904	Unicorn-37236.exe
1564	Unicorn-65270.exe
1620	Unicorn-38026.exe
1688	Unicorn-22244.exe
1184	Unicorn-62530.exe
2268	Unicorn-54917.exe
1056	Unicorn-46002.exe
2248	Unicorn-42472.exe
2956	Unicorn-13137.exe
760	Unicorn-29474.exe
2888	Unicorn-30028.exe
1664	Unicorn-33558.exe
1964	Unicorn-41965.exe
2128	Unicorn-46604.exe
2732	Unicorn-62385.exe
2692	Unicorn-39779.exe
2696	Unicorn-2276.exe
2620	Unicorn-52032.exe
2564	Unicorn-22697.exe
2500	Unicorn-31419.exe
2252	Unicorn-47201.exe
320	Unicorn-26589.exe
2952	Unicorn-36463.exe
2800	Unicorn-56329.exe
2452	Unicorn-56329.exe
1548	Unicorn-56329.exe
2932	Unicorn-56329.exe
2836	Unicorn-47647.exe
1120	Unicorn-2805.exe
1244	Unicorn-22671.exe
992	Unicorn-36245.exe
588	Unicorn-36245.exe
764	Unicorn-36245.exe
328	Unicorn-56111.exe
564	Unicorn-56111.exe
2556	Unicorn-56111.exe
1132	Unicorn-41673.exe
2124	Unicorn-86.exe
448	Unicorn-58010.exe
768	Unicorn-45758.exe
1992	Unicorn-16423.exe
1692	Unicorn-16423.exe
1168	Unicorn-28675.exe
2900	Unicorn-449.exe

Loads dropped DLL 64 IoCs

pid	Process
948	ded2dae5fb60b3025b14d5bca874eb94.exe
948	ded2dae5fb60b3025b14d5bca874eb94.exe
1900	Unicorn-8020.exe
1900	Unicorn-8020.exe
948	ded2dae5fb60b3025b14d5bca874eb94.exe
948	ded2dae5fb60b3025b14d5bca874eb94.exe
960	Unicorn-41015.exe
960	Unicorn-41015.exe
1900	Unicorn-8020.exe
1900	Unicorn-8020.exe
1880	Unicorn-50807.exe
1880	Unicorn-50807.exe
2608	Unicorn-58586.exe
2608	Unicorn-58586.exe
960	Unicorn-41015.exe
960	Unicorn-41015.exe
1164	Unicorn-46889.exe
1164	Unicorn-46889.exe
2868	Unicorn-62670.exe
2868	Unicorn-62670.exe
1880	Unicorn-50807.exe
1880	Unicorn-50807.exe
2516	Unicorn-63905.exe
2516	Unicorn-63905.exe
2608	Unicorn-58586.exe
2608	Unicorn-58586.exe
2148	Unicorn-60376.exe
2148	Unicorn-60376.exe
2404	Unicorn-26957.exe
2404	Unicorn-26957.exe
1980	Unicorn-31595.exe
1980	Unicorn-31595.exe
1164	Unicorn-46889.exe
1164	Unicorn-46889.exe
1968	Unicorn-31041.exe
1968	Unicorn-31041.exe
2868	Unicorn-62670.exe
2868	Unicorn-62670.exe
2864	Unicorn-65104.exe
2864	Unicorn-65104.exe
2516	Unicorn-63905.exe
2516	Unicorn-63905.exe
1952	Unicorn-49323.exe
1952	Unicorn-49323.exe
1432	Unicorn-48576.exe
1432	Unicorn-48576.exe
2148	Unicorn-60376.exe
2148	Unicorn-60376.exe
3024	Unicorn-57211.exe
3024	Unicorn-57211.exe
2404	Unicorn-26957.exe
2404	Unicorn-26957.exe
1808	Unicorn-61295.exe
1808	Unicorn-61295.exe
1980	Unicorn-31595.exe
1980	Unicorn-31595.exe
2224	Unicorn-49598.exe
2224	Unicorn-49598.exe
2552	Unicorn-12649.exe
2552	Unicorn-12649.exe
1968	Unicorn-31041.exe
1968	Unicorn-31041.exe
772	Unicorn-24347.exe
772	Unicorn-24347.exe

Program crash 51 IoCs

pid	pid_target	Process	procid_target
2652	1564	WerFault.exe	49
572	2864	WerFault.exe	39
2256	1964	WerFault.exe	60
2404	2312	WerFault.exe	47
1704	2128	WerFault.exe	61
2244	1244	WerFault.exe	78
2800	1120	WerFault.exe	77
2592	2148	WerFault.exe	102
2252	3016	WerFault.exe	114
1880	1856	WerFault.exe	133
1988	3068	WerFault.exe	132
1436	448	WerFault.exe	166
1644	2636	WerFault.exe	146
1080	540	WerFault.exe	176
948	1304	WerFault.exe	190
2704	2460	WerFault.exe	191
1464	1680	WerFault.exe	208
2892	1164	WerFault.exe	207
2284	2996	WerFault.exe	202
1072	1640	WerFault.exe	210
668	2808	WerFault.exe	235
2848	2328	WerFault.exe	211
3408	404	WerFault.exe	229
3816	2428	WerFault.exe	259
3592	1492	WerFault.exe	264
2500	956	WerFault.exe	272
4068	2184	WerFault.exe	257
2544	1536	WerFault.exe	270
3360	2464	WerFault.exe	278
2172	3232	WerFault.exe	299
588	3260	WerFault.exe	317
2700	3680	WerFault.exe	309
3664	3280	WerFault.exe	300
112	3440	WerFault.exe	343
3880	3828	WerFault.exe	332
3780	2092	WerFault.exe	371
3728	3428	WerFault.exe	363
1196	2368	WerFault.exe	381
3304	3024	WerFault.exe	372
4296	3924	WerFault.exe	407
4124	3172	WerFault.exe	408
1580	2964	WerFault.exe	426
4284	1500	WerFault.exe	409
4244	3476	WerFault.exe	424
4160	4328	WerFault.exe	467
3884	3928	WerFault.exe	459
3364	4128	WerFault.exe	462
3276	4920	WerFault.exe	475
3300	3084	WerFault.exe	492
3784	3732	WerFault.exe	524
3888	4324	WerFault.exe	504

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
948	ded2dae5fb60b3025b14d5bca874eb94.exe
1900	Unicorn-8020.exe
960	Unicorn-41015.exe
1880	Unicorn-50807.exe
2608	Unicorn-58586.exe
1164	Unicorn-46889.exe
2868	Unicorn-62670.exe
2516	Unicorn-63905.exe
2148	Unicorn-60376.exe
2404	Unicorn-26957.exe
1980	Unicorn-31595.exe
1968	Unicorn-31041.exe
2864	Unicorn-65104.exe
1952	Unicorn-49323.exe
1432	Unicorn-48576.exe
3024	Unicorn-57211.exe
1808	Unicorn-61295.exe
2224	Unicorn-49598.exe
2552	Unicorn-12649.exe
772	Unicorn-24347.exe
2312	Unicorn-53018.exe
2904	Unicorn-37236.exe
1564	Unicorn-65270.exe
1620	Unicorn-38026.exe
1688	Unicorn-22244.exe
1184	Unicorn-62530.exe
2268	Unicorn-54917.exe
1056	Unicorn-46002.exe
2956	Unicorn-13137.exe
2248	Unicorn-42472.exe
1664	Unicorn-33558.exe
760	Unicorn-29474.exe
1964	Unicorn-41965.exe
2732	Unicorn-62385.exe
2128	Unicorn-46604.exe
2692	Unicorn-39779.exe
2696	Unicorn-2276.exe
2620	Unicorn-52032.exe
2564	Unicorn-22697.exe
2500	Unicorn-31419.exe
2252	Unicorn-47201.exe
320	Unicorn-26589.exe
1548	Unicorn-56329.exe
2952	Unicorn-36463.exe
2932	Unicorn-56329.exe
2800	Unicorn-56329.exe
2452	Unicorn-56329.exe
2836	Unicorn-47647.exe
1120	Unicorn-2805.exe
1244	Unicorn-22671.exe
588	Unicorn-36245.exe
992	Unicorn-36245.exe
328	Unicorn-56111.exe
764	Unicorn-36245.exe
564	Unicorn-56111.exe
2556	Unicorn-56111.exe
448	Unicorn-58010.exe
1132	Unicorn-41673.exe
2124	Unicorn-86.exe
768	Unicorn-45758.exe
1992	Unicorn-16423.exe
1692	Unicorn-16423.exe
1168	Unicorn-28675.exe
1752	Unicorn-20315.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1900	948	ded2dae5fb60b3025b14d5bca874eb94.exe	28
PID 948 wrote to memory of 1900	948	ded2dae5fb60b3025b14d5bca874eb94.exe	28
PID 948 wrote to memory of 1900	948	ded2dae5fb60b3025b14d5bca874eb94.exe	28
PID 948 wrote to memory of 1900	948	ded2dae5fb60b3025b14d5bca874eb94.exe	28
PID 1900 wrote to memory of 960	1900	Unicorn-8020.exe	29
PID 1900 wrote to memory of 960	1900	Unicorn-8020.exe	29
PID 1900 wrote to memory of 960	1900	Unicorn-8020.exe	29
PID 1900 wrote to memory of 960	1900	Unicorn-8020.exe	29
PID 948 wrote to memory of 1880	948	ded2dae5fb60b3025b14d5bca874eb94.exe	30
PID 948 wrote to memory of 1880	948	ded2dae5fb60b3025b14d5bca874eb94.exe	30
PID 948 wrote to memory of 1880	948	ded2dae5fb60b3025b14d5bca874eb94.exe	30
PID 948 wrote to memory of 1880	948	ded2dae5fb60b3025b14d5bca874eb94.exe	30
PID 960 wrote to memory of 2608	960	Unicorn-41015.exe	31
PID 960 wrote to memory of 2608	960	Unicorn-41015.exe	31
PID 960 wrote to memory of 2608	960	Unicorn-41015.exe	31
PID 960 wrote to memory of 2608	960	Unicorn-41015.exe	31
PID 1900 wrote to memory of 1164	1900	Unicorn-8020.exe	32
PID 1900 wrote to memory of 1164	1900	Unicorn-8020.exe	32
PID 1900 wrote to memory of 1164	1900	Unicorn-8020.exe	32
PID 1900 wrote to memory of 1164	1900	Unicorn-8020.exe	32
PID 1880 wrote to memory of 2868	1880	Unicorn-50807.exe	33
PID 1880 wrote to memory of 2868	1880	Unicorn-50807.exe	33
PID 1880 wrote to memory of 2868	1880	Unicorn-50807.exe	33
PID 1880 wrote to memory of 2868	1880	Unicorn-50807.exe	33
PID 2608 wrote to memory of 2516	2608	Unicorn-58586.exe	34
PID 2608 wrote to memory of 2516	2608	Unicorn-58586.exe	34
PID 2608 wrote to memory of 2516	2608	Unicorn-58586.exe	34
PID 2608 wrote to memory of 2516	2608	Unicorn-58586.exe	34
PID 960 wrote to memory of 2148	960	Unicorn-41015.exe	35
PID 960 wrote to memory of 2148	960	Unicorn-41015.exe	35
PID 960 wrote to memory of 2148	960	Unicorn-41015.exe	35
PID 960 wrote to memory of 2148	960	Unicorn-41015.exe	35
PID 1164 wrote to memory of 2404	1164	Unicorn-46889.exe	36
PID 1164 wrote to memory of 2404	1164	Unicorn-46889.exe	36
PID 1164 wrote to memory of 2404	1164	Unicorn-46889.exe	36
PID 1164 wrote to memory of 2404	1164	Unicorn-46889.exe	36
PID 2868 wrote to memory of 1968	2868	Unicorn-62670.exe	37
PID 2868 wrote to memory of 1968	2868	Unicorn-62670.exe	37
PID 2868 wrote to memory of 1968	2868	Unicorn-62670.exe	37
PID 2868 wrote to memory of 1968	2868	Unicorn-62670.exe	37
PID 1880 wrote to memory of 1980	1880	Unicorn-50807.exe	38
PID 1880 wrote to memory of 1980	1880	Unicorn-50807.exe	38
PID 1880 wrote to memory of 1980	1880	Unicorn-50807.exe	38
PID 1880 wrote to memory of 1980	1880	Unicorn-50807.exe	38
PID 2516 wrote to memory of 2864	2516	Unicorn-63905.exe	39
PID 2516 wrote to memory of 2864	2516	Unicorn-63905.exe	39
PID 2516 wrote to memory of 2864	2516	Unicorn-63905.exe	39
PID 2516 wrote to memory of 2864	2516	Unicorn-63905.exe	39
PID 2608 wrote to memory of 1952	2608	Unicorn-58586.exe	40
PID 2608 wrote to memory of 1952	2608	Unicorn-58586.exe	40
PID 2608 wrote to memory of 1952	2608	Unicorn-58586.exe	40
PID 2608 wrote to memory of 1952	2608	Unicorn-58586.exe	40
PID 2148 wrote to memory of 1432	2148	Unicorn-60376.exe	41
PID 2148 wrote to memory of 1432	2148	Unicorn-60376.exe	41
PID 2148 wrote to memory of 1432	2148	Unicorn-60376.exe	41
PID 2148 wrote to memory of 1432	2148	Unicorn-60376.exe	41
PID 2404 wrote to memory of 3024	2404	Unicorn-26957.exe	42
PID 2404 wrote to memory of 3024	2404	Unicorn-26957.exe	42
PID 2404 wrote to memory of 3024	2404	Unicorn-26957.exe	42
PID 2404 wrote to memory of 3024	2404	Unicorn-26957.exe	42
PID 1980 wrote to memory of 1808	1980	Unicorn-31595.exe	43
PID 1980 wrote to memory of 1808	1980	Unicorn-31595.exe	43
PID 1980 wrote to memory of 1808	1980	Unicorn-31595.exe	43
PID 1980 wrote to memory of 1808	1980	Unicorn-31595.exe	43

C:\Users\Admin\AppData\Local\Temp\ded2dae5fb60b3025b14d5bca874eb94.exe
"C:\Users\Admin\AppData\Local\Temp\ded2dae5fb60b3025b14d5bca874eb94.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41965.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22671.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        10⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        11⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        12⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        13⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        14⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        15⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49275.exe
        16⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        17⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
        18⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
        19⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
        20⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58874.exe
        21⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        22⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 376
        21⤵
        Program crash
        
        PID:3888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 380
        20⤵
        Program crash
        
        PID:3884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 376
        19⤵
        Program crash
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 376
        18⤵
        Program crash
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 380
        17⤵
        Program crash
        
        PID:3664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 380
        16⤵
        Program crash
        
        PID:4068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 376
        15⤵
        Program crash
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        14⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        15⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2700.exe
        16⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        17⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
        18⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
        19⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7955.exe
        20⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        21⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
        22⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 376
        17⤵
        Program crash
        
        PID:588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 380
        16⤵
        Program crash
        
        PID:3360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 380
        15⤵
        Program crash
        
        PID:3816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 376
        14⤵
        Program crash
        
        PID:1072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 380
        13⤵
        Program crash
        
        PID:1080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 376
        12⤵
        Program crash
        
        PID:1988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 376
        11⤵
        Program crash
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 376
        10⤵
        Program crash
        
        PID:2244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 368
        9⤵
        Program crash
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2805.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58436.exe
        9⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        10⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        11⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
        12⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35897.exe
        13⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        14⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59353.exe
        15⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        16⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33739.exe
        17⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28568.exe
        18⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        19⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56622.exe
        20⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        18⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        19⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 380
        11⤵
        Program crash
        
        PID:1644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 376
        10⤵
        Program crash
        
        PID:2252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 376
        9⤵
        Program crash
        
        PID:2800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 376
        8⤵
        Program crash
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46604.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        9⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34093.exe
        10⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        11⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        12⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59908.exe
        13⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        14⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1792.exe
        15⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6940.exe
        16⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10500.exe
        17⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        18⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        19⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        20⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 380
        8⤵
        Program crash
        
        PID:1704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 368
        7⤵
        Program crash
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        8⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31637.exe
        9⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19890.exe
        10⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        11⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        12⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        13⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38632.exe
        14⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8907.exe
        15⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        16⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        17⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56155.exe
        18⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        9⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        10⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        11⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        12⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32363.exe
        13⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54309.exe
        14⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        15⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        16⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        17⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        18⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28527.exe
        19⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        16⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        17⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        18⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16669.exe
        10⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        11⤵
        
        PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 240
        7⤵
        Program crash
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        8⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        9⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        10⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        11⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        12⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34595.exe
        13⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        14⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        15⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        16⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        17⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 376
        16⤵
        Program crash
        
        PID:3364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 376
        15⤵
        Program crash
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 376
        14⤵
        Program crash
        
        PID:1196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 376
        13⤵
        Program crash
        
        PID:3880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 372
        12⤵
        Program crash
        
        PID:2172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 376
        11⤵
        Program crash
        
        PID:3592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 368
        10⤵
        Program crash
        
        PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        8⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        9⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        10⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15889.exe
        11⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16468.exe
        12⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        13⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        14⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
        15⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        16⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        17⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43176.exe
        18⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23384.exe
        19⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        20⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10880.exe
        8⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        9⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25051.exe
        10⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
        11⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        12⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        13⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        14⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        15⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29930.exe
        16⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        17⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        18⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        9⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41112.exe
        10⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        11⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31813.exe
        12⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        13⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45373.exe
        14⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        15⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18202.exe
        16⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        17⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        18⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        19⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        14⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        15⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20553.exe
        16⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48220.exe
        17⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13731.exe
        18⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37217.exe
        8⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55027.exe
        9⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        10⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58159.exe
        11⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        12⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8341.exe
        13⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        14⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        15⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        16⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        17⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        8⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        9⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
        10⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        11⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        12⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        13⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        14⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        15⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        16⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        17⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        11⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        12⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        13⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30921.exe
        14⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        15⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
        16⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37463.exe
        17⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8991.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        8⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        9⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
        10⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        11⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        12⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        13⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        14⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        15⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24443.exe
        16⤵
        
        PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        9⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        10⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31099.exe
        11⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        12⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        13⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45855.exe
        14⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        15⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        16⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55674.exe
        17⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27221.exe
        18⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        19⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
        20⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30939.exe
        21⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16308.exe
        9⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33377.exe
        10⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        11⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        12⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        13⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17828.exe
        14⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24263.exe
        15⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        16⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
        17⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        18⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        19⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        14⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19546.exe
        15⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52605.exe
        16⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        17⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        18⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41673.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        8⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        9⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        10⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 240
        11⤵
        Program crash
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31419.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21213.exe
        8⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27622.exe
        9⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        10⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        11⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 240
        12⤵
        Program crash
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51934.exe
        8⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
        9⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        10⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58268.exe
        11⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
        12⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        13⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17553.exe
        14⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        15⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        16⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        17⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38869.exe
        18⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        19⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        14⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
        15⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        16⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        17⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        18⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23867.exe
        19⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        17⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
        18⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        11⤵
        
        PID:956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 220
        12⤵
        Program crash
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        9⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        10⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44127.exe
        11⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        12⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        13⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29006.exe
        14⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16469.exe
        15⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
        16⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51412.exe
        17⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        9⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63340.exe
        10⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62575.exe
        11⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        12⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        13⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        14⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        15⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        16⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33525.exe
        17⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33695.exe
        18⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        19⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63703.exe
        9⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        10⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        11⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        12⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        13⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
        14⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10251.exe
        15⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        16⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        17⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        18⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        19⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
        16⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56248.exe
        17⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        18⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        9⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51833.exe
        10⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1112.exe
        11⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        12⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25804.exe
        13⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        14⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        15⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        16⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56295.exe
        17⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        18⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36174.exe
        8⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        9⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        10⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31330.exe
        11⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        12⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        13⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57817.exe
        14⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        15⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45280.exe
        16⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        17⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10996.exe
        18⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        19⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
        20⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 376
        16⤵
        Program crash
        
        PID:3780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 376
        15⤵
        Program crash
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10946.exe
        14⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        15⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        16⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        17⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        18⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
        19⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 380
        18⤵
        Program crash
        
        PID:3276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 376
        17⤵
        Program crash
        
        PID:4244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 376
        16⤵
        Program crash
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35585.exe
        15⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53391.exe
        16⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        17⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        18⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
        19⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 376
        18⤵
        Program crash
        
        PID:3300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 376
        17⤵
        Program crash
        
        PID:4160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 368
        16⤵
        Program crash
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 376
        15⤵
        Program crash
        
        PID:3304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 372
        14⤵
        Program crash
        
        PID:2700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 380
        13⤵
        Program crash
        
        PID:2544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 376
        12⤵
        Program crash
        
        PID:3408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 380
        11⤵
        Program crash
        
        PID:2284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 376
        10⤵
        Program crash
        
        PID:1436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 376
        9⤵
        Program crash
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17373.exe
        8⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17075.exe
        9⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28144.exe
        10⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        11⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38497.exe
        12⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        13⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        14⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        15⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57073.exe
        16⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        17⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32310.exe
        18⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64331.exe
        8⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-128.exe
        9⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 220
        10⤵
        Program crash
        
        PID:948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33558.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47647.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        8⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-543.exe
        9⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        10⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28061.exe
        11⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18409.exe
        12⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        13⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        14⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
        15⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        16⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23960.exe
        17⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        18⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19676.exe
        9⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        10⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        8⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17041.exe
        9⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
        10⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        11⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62176.exe
        12⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53256.exe
        13⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53500.exe
        14⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20675.exe
        15⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        16⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12649.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29474.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1944.exe
        7⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        8⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        9⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        10⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        11⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
        12⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        13⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        14⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        15⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        16⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11232.exe
        17⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        18⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60602.exe
        19⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        16⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        17⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        18⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        19⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        9⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        10⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 240
        11⤵
        Program crash
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
        8⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25671.exe
        9⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54791.exe
        10⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        11⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49192.exe
        12⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-448.exe
        13⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
        14⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        15⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        16⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
        17⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        18⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16423.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
        7⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42069.exe
        8⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        9⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        10⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40588.exe
        11⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        12⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
        13⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        14⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36681.exe
        15⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16277.exe
        16⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        17⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        18⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31734.exe
        19⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        17⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        18⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        12⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        13⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        14⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        15⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        16⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
        17⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        18⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        19⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        20⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9047.exe
        16⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        17⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
        18⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        9⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        10⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        11⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6208.exe
        12⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        13⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        14⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        15⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        16⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
        17⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        18⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8085.exe
        17⤵
        
        PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-86.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-86.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        8⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        9⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        10⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58010.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33849.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        8⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26200.exe
        9⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        10⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19867.exe
        11⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60183.exe
        12⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        13⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        14⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52327.exe
        15⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        16⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        17⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61941.exe
        18⤵
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42472.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35292.exe
        9⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        10⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        11⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        12⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        13⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        14⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        15⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        16⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51370.exe
        17⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        18⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        19⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        14⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
        15⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        16⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        17⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 240
        18⤵
        Program crash
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        8⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        9⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
        10⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
        11⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        12⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        13⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        14⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54543.exe
        15⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54162.exe
        16⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53799.exe
        17⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-449.exe
        5⤵
        Executes dropped EXE
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8680.exe
        8⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1973.exe
        9⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
        10⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
        11⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        12⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        13⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20060.exe
        14⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        15⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55771.exe
        16⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
        7⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
        8⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35212.exe
        9⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        10⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        11⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        12⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        13⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        14⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        15⤵
        
        PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe

Filesize
184KB

MD5
d1c7b7bd5e01dca21309c6bb90096ce1

SHA1
92fd6bf59e5d5a7da923f36852f2bc3704249a08

SHA256
d1197ac34abe8ff7bc74e5d6aa3a747241b89f948eafbc21cc6222142f2aab97

SHA512
1ac2cc1dead0d8d2bbff9ae723a24dc942c633f6f1cde4651859f5a79185f838cb2f40e5090d83fdcc5c2ee1b0c3f5018ca405c5b5611054bc0ace0196cfe439

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe

Filesize
184KB

MD5
57a1607a772469676dd3bb1c2d848e4a

SHA1
e7b1b9315523e3ce338718f66dd27a2a6ec43d10

SHA256
8a8a4ebdfc19f8eddf7f6bbb55b99899cd8246057114eafd40e7a6a239d10e0e

SHA512
d3b6356c68e84f449e0d329e25984b5644d8dc76fa2c19c0ef3e938dfe5a83e0bdc6fc6e0fc1feaa96a5b70aa6feb2ac2618b33610cfc863d03ca7fbf5953e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe

Filesize
184KB

MD5
414f09396c269f01eea308b72c1eac47

SHA1
ea66c6d2e442654325d94fbe1f83a03152ea7423

SHA256
b4339c64515d52c5454956c128496b77af28cae79b6c3e58663ad8a2a7e2a71e

SHA512
2276b77a8c1bfa95b0b2e98b12b9de14e611e31910ddbe659959acdaab095fc5e05938f7870542d4ce0315b7bd142d046ce20f2cbeb9d69a657ce0f88710f88b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31595.exe

Filesize
184KB

MD5
b6f44ee189af50075e49204eda1afc4b

SHA1
82f8b2f4817d554fd9808efafc5b34528d922875

SHA256
e120c0f2c1048c969baabc05808039a2282ab4ae98500a11d3ce2bacfec54015

SHA512
2a2ea94d059b780f81d5bbe4df5936ba50cc10a7fbd0c6f3facd7328dcbff75d66d53a6d998556006d8351f526bd900fba29e6d3c7859e783f707d54d6f4bec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe

Filesize
184KB

MD5
f330e3f77834d0e941b2235cf65306f4

SHA1
f23b7b1d89d76a34c160f96e28a85dc75e4e1645

SHA256
07635d82971b9171090ec5c13e8d4862670e98d1d072423759f72734d14e4f6e

SHA512
c4df1c6205cfd0f0ac8fcdec7f3b0d181bb0f6ad523edec3c5e000bde2d8c20d469899a3ca6b1a410f6a200b25110cddb5af6e7724522fdf90bd731716641dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe

Filesize
184KB

MD5
93d3b2db094a5a7bcd6138cde263772c

SHA1
fe9c22432e99a053c6a0404872cdd8b9a1e3fb59

SHA256
580b315b3eaee0d86c419ae0d5d795b13b308a6b59f5cb5609f031e264493ef6

SHA512
e03a7205d06cd253970eef92581364ac7b519279310d5a5fea95d451c3d7ba2eae8c63c5430995875c390bfa73d9df934626ec90f9f1e74310199098f938cc2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe

Filesize
184KB

MD5
5bd341b16c52bed40934e7b44573e8be

SHA1
2840d376fd15b98b8c4a3adb129e7d6c73a7402b

SHA256
eb9387546e7751daf0c6eaac19e9a003b9d0fb04d023444b5d3fe56439db7dd4

SHA512
46a508d3da7e0ede8ce9e5dc52c3202ce7905508b887a0edd48757789b68b473f676d88eb608487f5089d5c3dd3834e2bb41ea819b3eb583cee222353a25d4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe

Filesize
184KB

MD5
f2b6c99ab9ae58dc3b88f79c72db0315

SHA1
179994d9e32160b754e18ed6552e846cf7897c5b

SHA256
9c798e9a0cbd99742b4364698c7a9af7988d714745b35e24b055ad032fb7fe8a

SHA512
3ed81427ecad4b2785f3af36f94d7fcf908a55f83ba5ab9d62f94ce54e7255942419a88faa182772dcd8b691845147394dfd801c9957e12af595ffea8cfe06e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe

Filesize
184KB

MD5
da1fa5db56042aa469cc15eba9a65346

SHA1
4ae3e1a91c592c2185d3e558ef10401a11312ef8

SHA256
7c7dcb470f6c609550d08f7d910b5a0f84cd17efdde9c0d77c12b4940c632c92

SHA512
94f4858c3a12e02bc910bb43fa3812e6986e36654d2fc0727f099de751f0ef32a313573efcfd5889a07859a4609e3447c5bbd5b478586959e1d426e174d32399

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe

Filesize
184KB

MD5
23f380c10e345cca0ce3f6fc6c8ee2ef

SHA1
c8ccbe91598e39cae5d45b73cbb2fa73bcb3ca44

SHA256
9f94d0b2cfe9aa4624399bb94916799a9714dc718a9e132bf9d6fe493201d735

SHA512
b8718533a2e23967d0f86c966922a656b972c1426b970b2761cfa281eb1dd55079173f7215f5418b545a3da786f08bcf476596ad6d37fdb828737871be6b1aa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe

Filesize
184KB

MD5
e84a5e5ec7b8955dfdbc3822b291ccfc

SHA1
05942fa372a20bb60a68dbfa58955a4ae84dcc95

SHA256
42f683224489a0d547d5379403737b0b24087a3637acdc5068fa837b4448f5f4

SHA512
2da5ec1fb8a0acd751aa04ab22dcc272a73c8c5d7d54188408e4232ac48693fb38fdc1836d487e66df9d1f20faf997bc4139e39db9cee78ab469b5c1ddfbabab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe

Filesize
184KB

MD5
4d15ee200adad232f3629512dcf4d54d

SHA1
c60d367e4c6a9f7a201a9a2facabf35214109d2d

SHA256
c196414484aa8b44518b864de8ea873f935ed8133ca314e6d9e83fd9783a6f69

SHA512
2234c5293538e08b12c2fe35c4197324c7c5f72b1864051964a4d9425cd272d3681e215f2f7cb861068e5308f8388a7d0f76aed122c32da72d6cd63905fd2d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe

Filesize
85KB

MD5
dc1cb58afc9762ce1fed9174f116f361

SHA1
87523dcff4c07843302ba041e016528f760fe939

SHA256
b304a2a231d48488df416ba42f2a495651872db4797f293cd45f7fc98a7bd0fa

SHA512
858ff5b8a66e279d03d0a44ea3db25f36e093b1a4c21aa7f3040c00b9fb5d7de3b924a7b413a87537e1ac7f8f2741c9a90bbe446882a3800543062c57427b805

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe

Filesize
184KB

MD5
1227fa96361ec8d86462a481cd073333

SHA1
66b409e74329e4dcb53da967d907710904d1be0a

SHA256
bafe735b98b4bdd081e9a3b4a5ab64cfe6da185c98f9e217a2325d1d8290fdba

SHA512
c91057f37acf8b72c220f57d7ae0a67e8831a21907520bb6e2d3ad0ca4c70989c7fd3d6850ae4151e33a0db286bba080f27c1c82b4d2908d15ad32d628653514

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26957.exe

Filesize
184KB

MD5
515b6284080dcb74476f0433711930d9

SHA1
f5874e44dbe5933e1d17059cceaff7d40198d75d

SHA256
263338074ce463842826e1f448600a0e7d92ce2538447a74f4605e296d9d1e6d

SHA512
e315e73e827297c1a1291549a1e33b6308ad69ccbaabb6ae71a8f5caccafb93e2423a567590b83f72d47ac411fd977a3dd6cbde929260fdcb208235e49025885

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe

Filesize
184KB

MD5
427731c0671592a685c1280443a3f70a

SHA1
713d6d8cc1f7549a66cdd8380a0b82c20ccf1bd2

SHA256
19807d0a99f09eba5467d775f686902a6462bc076c7a529cf7b64bdcf5978319

SHA512
3c380627a57c9050e1929239c537106f2925cc893f8e848a43cba7ddde4adc2c3bddf7b6b12d9836ac96484210146324d73af8d84dd964d41b3c37e5d910d434

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe

Filesize
184KB

MD5
029e3eee4acd18ffd2e54833f975bb52

SHA1
bd6bac9e96f2c8bfd51c3a66302be32dd92c9cbf

SHA256
d519806cc002afacc6f6349edb33359925910d88009779bcc8308174f2fab297

SHA512
63ebdff8da7dea7b938275b0a68329edf7f86bb9fe89a27a10f06ff0507ae20a92a8a4d00ec5f1bfbdb180619f2927e1ccdef5e05df007da5a29f93d0f3c35fe

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe

Filesize
184KB

MD5
42414c90acebbbb5180f155b23a72805

SHA1
532d282988868d386fd78d1e4b01860fb8ff42c0

SHA256
d9d5f66e06f7f66b7f7cb0362fbc816bdcf3dc98851d6dd8ffa264166a4449f0

SHA512
47f96b1203083ed2bec910557346a839431d71dfbcad6f80316c747813afa1c75cb1fa486c47f02ec24634a537bb8e5d40a9b97d3b0137a45ed46618e93a8d46

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe

Filesize
184KB

MD5
778dfe6290548978fc8f3f2fac480ac9

SHA1
2d9038395b51b5db99d04233a43a0247356f7292

SHA256
41c3bf9059abd70632a1533b67105052f80761eff735a0813f31136770455ed2

SHA512
3bea4b948de219886a76b759b3cb519190978a44735ee0470dcccb7b7c5513fcf74aec5fb54f357c9ce75a1f982c02cd909033a91643a4f21233c835b0cee101

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49598.exe

Filesize
184KB

MD5
868b5abe28e0cbc544d25aded8db1afa

SHA1
f45e46e6e94d3d2fbea401a7acde25c6135f4b68

SHA256
ff536cd66c78ee522cd65ba89d005a0637a9baddeff5718d4c9e60d02c8af2e0

SHA512
440be7ac13bcc5c99907e2ba7baeee6278fa6657d239b5eb3b0f284b6adc016877f25a292b87e6f305a88fe9c342408677bc6ebbc656a53ea454a026730e3ce5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe

Filesize
184KB

MD5
d44a8ea1b08e06a6aa5fcdf2f31649a7

SHA1
bd717a0a2c43df6a55da32c2c1727411026df7bb

SHA256
97c3a897b706b50fb6ee091f1500562658099e275c680de64267a28f6473781b

SHA512
f29ed3466a403a9d0ad4b9231e7024d6629d10109907b4c1a703548c4dced14bbc69c37725029e49fa3c3ef66c30468c61fb575a8dd185ab29b498125ffd5d94

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe

Filesize
184KB

MD5
ec4f50a7b07e2568f2a82082a66bb8be

SHA1
c1b4e054bd13d1e77e88accdb26f7b6db5248d23

SHA256
c459ca793dbf0c8eceead2d84d291c5f22b714bd87f9c7444f17370afba3ded7

SHA512
f0896502fd42ffabb94f834348ada915df2f9915d8df5a06eb0fdd04e9ae73bf34cc9f34d8d4b83f57fac8238f210f2242dec9f2fe9ef20b713c126242c03fd0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe

Filesize
184KB

MD5
ced6537f54ce2eec9416c207cd3bfacf

SHA1
49a6b6eb202162903d3fc760212b6d0b40a9555c

SHA256
a1a38ae0c5f7be5179dba67190929b640e24b022e3aa31e4ae09710ae847c616

SHA512
9d50925392e38d5ea43cd7de367e5f07dc61018ea84579dd0a03f6b1f6b801d9767c81987857815c74b2d5be4c1a7ef249b9840d10924c3ad8a81cd0eebe15cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe

Filesize
184KB

MD5
7353ae9c625b0affc2df4d4ebf6a2dbe

SHA1
f372f945764a8f484ad2780bae6ff50a9aaddca4

SHA256
c7015e48010182dc36b4787aaeae0c94a6235af7ed496a7428b2813c923b6ba0

SHA512
691f319a5e7b6c0fd4551bf48cf4d16327c7adf1e31105f460f92ec8fd014aff8a52280e2d58d486d831ba40249de7a4a1921f5db4f553fe7a647d44ed6b94c0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe

Filesize
184KB

MD5
b5c711171af7748c8721430d41015791

SHA1
297b523c9a045af3cc359c48770eec466ef70583

SHA256
780fe1d091f2cfad29e55cb053ca5cc10a1a120c93a0595dcda472f9c9f340c6

SHA512
1be449e2536ee9b49dd07b09e3265b1ed2c6dbb6db2f0aee3b597640b69f4e51bc94f52755783c8de87b2d6216226fedaba987381ce044199b619e292e51b288

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe

Filesize
184KB

MD5
81097b2b951b7ffe0eaa106a1f62408e

SHA1
c7f3237ed33555441cb9f685b94821ecb2a36b54

SHA256
e2fd7cec16585e9a7274887d8761a2b18f3ba64b6a4fb605f8d2d991810b4ca1

SHA512
97586237a0fa444c7fd9dcb66ea55b51da18376db814a665c6f20b1234822092a879c6933f9ff24b40c02a90d505e33ab24a80ea82d7ba0e8860ffc12dc4519e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads