b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
Size

184KB
MD5

6bfcc333a4c785d0a3aae69daf89e5c0
SHA1

dfb3afdcfde846a604045a8c94830ab77230b491
SHA256

b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c
SHA512

768e14fc46b395ad8d090ed60758c6b55c41393accbf6dbe5212ea94d24863224bfe6cc3c91375f629eea36aafe22b0e65d8c4cdde1ed60354fcf869b7a0a2af
SSDEEP

3072:rzK/qpoMpsJ+DTwiTy/fz2XWkDvnq9viu/:rz5oUnwiKz4WkDPq9viu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2116	Unicorn-6661.exe
2580	Unicorn-1290.exe
2636	Unicorn-60283.exe
2620	Unicorn-13900.exe
1108	Unicorn-59572.exe
2488	Unicorn-64947.exe
2624	Unicorn-5540.exe
2960	Unicorn-25598.exe
2532	Unicorn-29682.exe
2804	Unicorn-1648.exe
3012	Unicorn-7023.exe
1284	Unicorn-13153.exe
2296	Unicorn-8804.exe
2124	Unicorn-38404.exe
2584	Unicorn-9069.exe
2248	Unicorn-45862.exe
2080	Unicorn-190.exe
2876	Unicorn-25655.exe
2344	Unicorn-26459.exe
556	Unicorn-50543.exe
992	Unicorn-63864.exe
1636	Unicorn-35830.exe
1832	Unicorn-29931.exe
640	Unicorn-29931.exe
1060	Unicorn-19302.exe
1296	Unicorn-33037.exe
2368	Unicorn-26153.exe
1692	Unicorn-39168.exe
1536	Unicorn-31000.exe
1364	Unicorn-20785.exe
1836	Unicorn-1472.exe
2408	Unicorn-60879.exe
2432	Unicorn-38975.exe
2200	Unicorn-22085.exe
1724	Unicorn-4986.exe
1600	Unicorn-63672.exe
1964	Unicorn-18001.exe
1280	Unicorn-54757.exe
2052	Unicorn-14471.exe
2716	Unicorn-37845.exe
2644	Unicorn-9811.exe
2760	Unicorn-29677.exe
2128	Unicorn-5727.exe
2824	Unicorn-9448.exe
2608	Unicorn-1280.exe
2956	Unicorn-62733.exe
2808	Unicorn-38783.exe
1480	Unicorn-54373.exe
2920	Unicorn-50024.exe
2036	Unicorn-54108.exe
1824	Unicorn-46205.exe
2972	Unicorn-40075.exe
1708	Unicorn-42121.exe
1624	Unicorn-18171.exe
1448	Unicorn-8487.exe
1812	Unicorn-29869.exe
1352	Unicorn-10003.exe
1272	Unicorn-16530.exe
1800	Unicorn-25785.exe
840	Unicorn-569.exe
1796	Unicorn-38072.exe
1008	Unicorn-37710.exe
2244	Unicorn-29277.exe
2324	Unicorn-25458.exe

Loads dropped DLL 64 IoCs

pid	Process
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2116	Unicorn-6661.exe
2116	Unicorn-6661.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2116	Unicorn-6661.exe
2580	Unicorn-1290.exe
2580	Unicorn-1290.exe
2116	Unicorn-6661.exe
2636	Unicorn-60283.exe
2636	Unicorn-60283.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2620	Unicorn-13900.exe
1108	Unicorn-59572.exe
1108	Unicorn-59572.exe
2620	Unicorn-13900.exe
2580	Unicorn-1290.exe
2580	Unicorn-1290.exe
2116	Unicorn-6661.exe
2116	Unicorn-6661.exe
2488	Unicorn-64947.exe
2488	Unicorn-64947.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2636	Unicorn-60283.exe
2636	Unicorn-60283.exe
2624	Unicorn-5540.exe
2624	Unicorn-5540.exe
1108	Unicorn-59572.exe
1108	Unicorn-59572.exe
2960	Unicorn-25598.exe
2960	Unicorn-25598.exe
3012	Unicorn-7023.exe
3012	Unicorn-7023.exe
2116	Unicorn-6661.exe
2116	Unicorn-6661.exe
1284	Unicorn-13153.exe
1284	Unicorn-13153.exe
2532	Unicorn-29682.exe
2532	Unicorn-29682.exe
2620	Unicorn-13900.exe
2620	Unicorn-13900.exe
2584	Unicorn-9069.exe
2804	Unicorn-1648.exe
2584	Unicorn-9069.exe
2804	Unicorn-1648.exe
2624	Unicorn-5540.exe
2580	Unicorn-1290.exe
2296	Unicorn-8804.exe
2624	Unicorn-5540.exe
2580	Unicorn-1290.exe
2296	Unicorn-8804.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
1472	WerFault.exe
2124	Unicorn-38404.exe
2124	Unicorn-38404.exe
2636	Unicorn-60283.exe
2636	Unicorn-60283.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1472	2488	WerFault.exe	34
1064	2080	WerFault.exe	44
1196	2128	WerFault.exe	72
2072	1272	WerFault.exe	88
588	1480	WerFault.exe	77
832	1060	WerFault.exe	53
2360	2036	WerFault.exe	79
268	1352	WerFault.exe	86
2428	2804	WerFault.exe	37
976	2824	WerFault.exe	73
1680	640	WerFault.exe	51
1676	1636	WerFault.exe	49
2220	1832	WerFault.exe	52
2008	888	WerFault.exe	99
1384	2292	WerFault.exe	98
1504	1308	WerFault.exe	102
1648	548	WerFault.exe	95
2976	1964	WerFault.exe	66
560	900	WerFault.exe	96
2044	2696	WerFault.exe	105
2500	1280	WerFault.exe	67
2660	2716	WerFault.exe	69
3108	1328	WerFault.exe	118
3552	2784	WerFault.exe	121
3592	2584	WerFault.exe	42
4036	892	WerFault.exe	142
4028	1816	WerFault.exe	187
4068	1292	WerFault.exe	117
3512	2212	WerFault.exe	101
3956	1768	WerFault.exe	176
3980	612	WerFault.exe	135
3700	1592	WerFault.exe	100
3752	2808	WerFault.exe	76
3948	2916	WerFault.exe	138
3580	1132	WerFault.exe	154
4900	2280	WerFault.exe	149
5024	3740	WerFault.exe	214
4296	3232	WerFault.exe	200
4924	4636	WerFault.exe	309
4116	3460	WerFault.exe	284
4192	3276	WerFault.exe	201
4828	2456	WerFault.exe	180
4528	1612	WerFault.exe	181
4600	2588	WerFault.exe	177
5220	1800	WerFault.exe	87
5932	704	WerFault.exe	130
5980	1608	WerFault.exe	113
5904	3876	WerFault.exe	218
5236	2528	WerFault.exe	191
5388	3340	WerFault.exe	252
5524	3436	WerFault.exe	267
5896	1688	WerFault.exe	103
5440	3528	WerFault.exe	239
5884	3824	WerFault.exe	245
5176	1448	WerFault.exe	84
6164	1000	WerFault.exe	269
6240	2692	WerFault.exe	155
6392	3396	WerFault.exe	234
6400	3444	WerFault.exe	296
6412	3828	WerFault.exe	217
6476	3032	WerFault.exe	194
6456	2948	WerFault.exe	192
6540	2524	WerFault.exe	193
6860	3296	WerFault.exe	231

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
2116	Unicorn-6661.exe
2580	Unicorn-1290.exe
2636	Unicorn-60283.exe
2620	Unicorn-13900.exe
1108	Unicorn-59572.exe
2488	Unicorn-64947.exe
2624	Unicorn-5540.exe
2532	Unicorn-29682.exe
2960	Unicorn-25598.exe
3012	Unicorn-7023.exe
2804	Unicorn-1648.exe
1284	Unicorn-13153.exe
2296	Unicorn-8804.exe
2584	Unicorn-9069.exe
2124	Unicorn-38404.exe
2248	Unicorn-45862.exe
2080	Unicorn-190.exe
2876	Unicorn-25655.exe
2344	Unicorn-26459.exe
556	Unicorn-50543.exe
992	Unicorn-63864.exe
1832	Unicorn-29931.exe
1636	Unicorn-35830.exe
640	Unicorn-29931.exe
1692	Unicorn-39168.exe
2368	Unicorn-26153.exe
1296	Unicorn-33037.exe
1060	Unicorn-19302.exe
1536	Unicorn-31000.exe
1364	Unicorn-20785.exe
1836	Unicorn-1472.exe
2408	Unicorn-60879.exe
2432	Unicorn-38975.exe
1964	Unicorn-18001.exe
1600	Unicorn-63672.exe
1724	Unicorn-4986.exe
2200	Unicorn-22085.exe
1280	Unicorn-54757.exe
2052	Unicorn-14471.exe
2716	Unicorn-37845.exe
2644	Unicorn-9811.exe
2760	Unicorn-29677.exe
2128	Unicorn-5727.exe
2824	Unicorn-9448.exe
1480	Unicorn-54373.exe
2608	Unicorn-1280.exe
2808	Unicorn-38783.exe
2956	Unicorn-62733.exe
2972	Unicorn-40075.exe
2920	Unicorn-50024.exe
2036	Unicorn-54108.exe
1824	Unicorn-46205.exe
1708	Unicorn-42121.exe
1624	Unicorn-18171.exe
1448	Unicorn-8487.exe
1812	Unicorn-29869.exe
1352	Unicorn-10003.exe
1272	Unicorn-16530.exe
1800	Unicorn-25785.exe
840	Unicorn-569.exe
1796	Unicorn-38072.exe
1008	Unicorn-37710.exe
2244	Unicorn-29277.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2116	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	28
PID 2884 wrote to memory of 2116	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	28
PID 2884 wrote to memory of 2116	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	28
PID 2884 wrote to memory of 2116	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	28
PID 2116 wrote to memory of 2580	2116	Unicorn-6661.exe	29
PID 2116 wrote to memory of 2580	2116	Unicorn-6661.exe	29
PID 2116 wrote to memory of 2580	2116	Unicorn-6661.exe	29
PID 2116 wrote to memory of 2580	2116	Unicorn-6661.exe	29
PID 2884 wrote to memory of 2636	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 2636	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 2636	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 2636	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	30
PID 2580 wrote to memory of 2620	2580	Unicorn-1290.exe	31
PID 2580 wrote to memory of 2620	2580	Unicorn-1290.exe	31
PID 2580 wrote to memory of 2620	2580	Unicorn-1290.exe	31
PID 2580 wrote to memory of 2620	2580	Unicorn-1290.exe	31
PID 2116 wrote to memory of 1108	2116	Unicorn-6661.exe	32
PID 2116 wrote to memory of 1108	2116	Unicorn-6661.exe	32
PID 2116 wrote to memory of 1108	2116	Unicorn-6661.exe	32
PID 2116 wrote to memory of 1108	2116	Unicorn-6661.exe	32
PID 2636 wrote to memory of 2624	2636	Unicorn-60283.exe	33
PID 2636 wrote to memory of 2624	2636	Unicorn-60283.exe	33
PID 2636 wrote to memory of 2624	2636	Unicorn-60283.exe	33
PID 2636 wrote to memory of 2624	2636	Unicorn-60283.exe	33
PID 2884 wrote to memory of 2488	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2488	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2488	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2488	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	34
PID 1108 wrote to memory of 2960	1108	Unicorn-59572.exe	36
PID 1108 wrote to memory of 2960	1108	Unicorn-59572.exe	36
PID 1108 wrote to memory of 2960	1108	Unicorn-59572.exe	36
PID 1108 wrote to memory of 2960	1108	Unicorn-59572.exe	36
PID 2620 wrote to memory of 2532	2620	Unicorn-13900.exe	35
PID 2620 wrote to memory of 2532	2620	Unicorn-13900.exe	35
PID 2620 wrote to memory of 2532	2620	Unicorn-13900.exe	35
PID 2620 wrote to memory of 2532	2620	Unicorn-13900.exe	35
PID 2580 wrote to memory of 2804	2580	Unicorn-1290.exe	37
PID 2580 wrote to memory of 2804	2580	Unicorn-1290.exe	37
PID 2580 wrote to memory of 2804	2580	Unicorn-1290.exe	37
PID 2580 wrote to memory of 2804	2580	Unicorn-1290.exe	37
PID 2116 wrote to memory of 3012	2116	Unicorn-6661.exe	38
PID 2116 wrote to memory of 3012	2116	Unicorn-6661.exe	38
PID 2116 wrote to memory of 3012	2116	Unicorn-6661.exe	38
PID 2116 wrote to memory of 3012	2116	Unicorn-6661.exe	38
PID 2488 wrote to memory of 1284	2488	Unicorn-64947.exe	39
PID 2488 wrote to memory of 1284	2488	Unicorn-64947.exe	39
PID 2488 wrote to memory of 1284	2488	Unicorn-64947.exe	39
PID 2488 wrote to memory of 1284	2488	Unicorn-64947.exe	39
PID 2884 wrote to memory of 2296	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2296	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2296	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2296	2884	b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe	40
PID 2636 wrote to memory of 2124	2636	Unicorn-60283.exe	41
PID 2636 wrote to memory of 2124	2636	Unicorn-60283.exe	41
PID 2636 wrote to memory of 2124	2636	Unicorn-60283.exe	41
PID 2636 wrote to memory of 2124	2636	Unicorn-60283.exe	41
PID 2624 wrote to memory of 2584	2624	Unicorn-5540.exe	42
PID 2624 wrote to memory of 2584	2624	Unicorn-5540.exe	42
PID 2624 wrote to memory of 2584	2624	Unicorn-5540.exe	42
PID 2624 wrote to memory of 2584	2624	Unicorn-5540.exe	42
PID 1108 wrote to memory of 2248	1108	Unicorn-59572.exe	43
PID 1108 wrote to memory of 2248	1108	Unicorn-59572.exe	43
PID 1108 wrote to memory of 2248	1108	Unicorn-59572.exe	43
PID 1108 wrote to memory of 2248	1108	Unicorn-59572.exe	43

C:\Users\Admin\AppData\Local\Temp\b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b1b8272cfd6f86a0788b794c7a773a71a46b3f4e02c460500890ad4751a4ae3c_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63864.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        8⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26392.exe
        9⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
        10⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        11⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        11⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe
        11⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 228
        10⤵
        Program crash
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        9⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40640.exe
        10⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46037.exe
        10⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
        10⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 228
        10⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46217.exe
        9⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11615.exe
        9⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48477.exe
        9⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        9⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 248
        8⤵
        Program crash
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42728.exe
        8⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61114.exe
        9⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26982.exe
        10⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        10⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        10⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54739.exe
        9⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 224
        9⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        8⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36198.exe
        9⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        9⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        9⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
        9⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        8⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 224
        9⤵
        Program crash
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57910.exe
        8⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 240
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36345.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        8⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58122.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13297.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        7⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14295.exe
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3937.exe
        9⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
        10⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        10⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        10⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45995.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        9⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 228
        9⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        9⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
        9⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        9⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39310.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38533.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1845.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5756.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27486.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39172.exe
        9⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 216
        9⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 228
        8⤵
        Program crash
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        8⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57359.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        8⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 224
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53801.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43247.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36454.exe
        7⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22495.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12430.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60774.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        7⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 224
        7⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30014.exe
        6⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22824.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        7⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51192.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        6⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52375.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        8⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        9⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        9⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
        8⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 224
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12084.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10759.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-583.exe
        8⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 244
        7⤵
        Program crash
        
        PID:5220
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 248
        6⤵
        Program crash
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 240
        6⤵
        Program crash
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51150.exe
        5⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        6⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        7⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 216
        7⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36736.exe
        6⤵
        
        PID:4336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 244
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
        5⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58419.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        6⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        5⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32271.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        5⤵
        
        PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46205.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        7⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 224
        8⤵
        Program crash
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22665.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40878.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55948.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51814.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36612.exe
        7⤵
        
        PID:11016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 248
        6⤵
        Program crash
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6298.exe
        6⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6888.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        8⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        8⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 216
        7⤵
        Program crash
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2629.exe
        6⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7054.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        7⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2553.exe
        6⤵
        
        PID:5160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 236
        6⤵
        
        PID:7972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 244
        5⤵
        Program crash
        
        PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9121.exe
        6⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62155.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5715.exe
        8⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 220
        8⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 216
        7⤵
        Program crash
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        6⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51045.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        7⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31141.exe
        6⤵
        
        PID:5312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 248
        6⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
        5⤵
        
        PID:1328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 220
        6⤵
        Program crash
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28174.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34307.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:9736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 244
        6⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        5⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4098.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56298.exe
        5⤵
        
        PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 224
        5⤵
        Program crash
        
        PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54737.exe
      4⤵
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56648.exe
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18154.exe
        6⤵
        
        PID:10716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 220
        6⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41709.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17465.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        5⤵
        
        PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54232.exe
      4⤵
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43977.exe
        5⤵
        
        PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8654.exe
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36448.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
      4⤵
      PID:12036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 240
        6⤵
        Program crash
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        6⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40507.exe
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        8⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
        9⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 248
        9⤵
        Program crash
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        8⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 220
        8⤵
        Program crash
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31702.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32182.exe
        8⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64587.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45554.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
        7⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        6⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22303.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63099.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        7⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 236
        7⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45721.exe
        6⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4220.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29845.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35046.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61201.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55691.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        6⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
        5⤵
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40699.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        7⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 240
        8⤵
        Program crash
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        7⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 240
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57100.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44734.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        7⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 244
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41194.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12292.exe
        6⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        5⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31189.exe
        7⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 244
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56601.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        6⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62690.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25409.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51610.exe
        6⤵
        
        PID:6184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 220
        6⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32615.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        5⤵
        
        PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46395.exe
        9⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 228
        9⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63324.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2821.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        8⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1065.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
        8⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 236
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38625.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32713.exe
        7⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29385.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55001.exe
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1827.exe
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12233.exe
        8⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11762.exe
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29073.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3568.exe
        7⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 216
        7⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11485.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13659.exe
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19580.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46776.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        6⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45167.exe
        6⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14225.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        8⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 224
        8⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 228
        7⤵
        Program crash
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17839.exe
        6⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 244
        7⤵
        Program crash
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        6⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8138.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        6⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30868.exe
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        7⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 216
        7⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        6⤵
        
        PID:6124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 220
        6⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59178.exe
        5⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56805.exe
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7302.exe
        6⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37469.exe
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        5⤵
        
        PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4134.exe
        6⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22329.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3556.exe
        8⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21749.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
        8⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27437.exe
        7⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 244
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe
        6⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 240
        7⤵
        Program crash
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        6⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
        6⤵
        
        PID:6700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 244
        6⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41637.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5774.exe
        6⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 224
        7⤵
        Program crash
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38594.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        6⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54221.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
        6⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5171.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
        5⤵
        
        PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56843.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        6⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        7⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 220
        7⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        6⤵
        
        PID:7272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 236
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        6⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39155.exe
        6⤵
        
        PID:1156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 224
        6⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        5⤵
        
        PID:5680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 248
        5⤵
        
        PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      4⤵
      PID:1132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 220
        5⤵
        Program crash
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
      4⤵
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50297.exe
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        5⤵
        
        PID:5308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 220
        5⤵
        
        PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36775.exe
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      4⤵
      PID:11720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22085.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22308.exe
        7⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24334.exe
        9⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        9⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        9⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 216
        8⤵
        Program crash
        
        PID:4528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 228
        7⤵
        Program crash
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        6⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60525.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35387.exe
        7⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 244
        7⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
        6⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12622.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
        7⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34911.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        6⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        5⤵
        
        PID:1308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 224
        6⤵
        Program crash
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53126.exe
        5⤵
        
        PID:2592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        6⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35315.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56690.exe
        7⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30062.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3350.exe
        6⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47829.exe
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54568.exe
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        6⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22804.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27255.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11482.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15406.exe
        5⤵
        
        PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63672.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        5⤵
        
        PID:888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 220
        6⤵
        Program crash
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        6⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        7⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
        6⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22160.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16809.exe
        6⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        5⤵
        
        PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10583.exe
      4⤵
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        5⤵
        
        PID:1768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 220
        6⤵
        Program crash
        
        PID:3956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 236
        5⤵
        Program crash
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30211.exe
      4⤵
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        5⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63286.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1111.exe
        6⤵
        
        PID:10184
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 228
        6⤵
        
        PID:11704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 228
        5⤵
        Program crash
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6683.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4049.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33718.exe
        5⤵
        
        PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55963.exe
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51596.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
      4⤵
      PID:10752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        5⤵
        
        PID:548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 244
        6⤵
        Program crash
        
        PID:1648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 248
        5⤵
        Program crash
        
        PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9100.exe
      4⤵
      PID:2292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 240
        5⤵
        Program crash
        
        PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15985.exe
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        5⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10951.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        6⤵
        
        PID:9844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 216
        6⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32481.exe
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5750.exe
        5⤵
        
        PID:6568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 236
        5⤵
        
        PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64357.exe
      4⤵
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7972.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4466.exe
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
      4⤵
      PID:10884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4986.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
      4⤵
      PID:900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 220
        5⤵
        Program crash
        
        PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59811.exe
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exe
        5⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43256.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
        6⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59327.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35311.exe
        5⤵
        
        PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
        5⤵
        
        PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
      4⤵
      PID:6020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 244
      4⤵
      PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
    3⤵
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
      4⤵
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11428.exe
        5⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7977.exe
        6⤵
        
        PID:4180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 236
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        5⤵
        
        PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
      4⤵
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        5⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26907.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        5⤵
        
        PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1271.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11855.exe
      4⤵
      PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
      4⤵
      PID:11652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    3⤵
    PID:484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31758.exe
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44210.exe
        5⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6997.exe
        5⤵
        
        PID:9688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 240
        5⤵
        
        PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
      4⤵
      PID:6780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 216
      4⤵
      PID:8424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
    3⤵
    PID:3528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 224
      4⤵
      Program crash
      PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
    3⤵
    PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
    3⤵
    PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
    3⤵
    PID:8328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
    3⤵
    PID:10484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 224
        7⤵
        Program crash
        
        PID:976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 248
        6⤵
        Program crash
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38783.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63475.exe
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40694.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32377.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40260.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55732.exe
        7⤵
        
        PID:10388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 216
        6⤵
        Program crash
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45285.exe
        5⤵
        
        PID:2784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 244
        6⤵
        Program crash
        
        PID:3552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 248
        5⤵
        Program crash
        
        PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 244
        6⤵
        Program crash
        
        PID:588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 248
        5⤵
        Program crash
        
        PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21566.exe
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1503.exe
        6⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 220
        7⤵
        Program crash
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16168.exe
        6⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54257.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        7⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53504.exe
        6⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35462.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        6⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3935.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        7⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24614.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        6⤵
        
        PID:7216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 216
        6⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15445.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        6⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3566.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48560.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12289.exe
        5⤵
        
        PID:8680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 244
        5⤵
        
        PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
      4⤵
      PID:1292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 224
        5⤵
        Program crash
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
      4⤵
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17967.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        5⤵
        
        PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44321.exe
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55488.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
      4⤵
      PID:10476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        6⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55520.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56838.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        9⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 220
        9⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40457.exe
        8⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 224
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
        7⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 224
        8⤵
        Program crash
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        7⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19871.exe
        7⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10958.exe
        6⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        7⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 244
        7⤵
        Program crash
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59159.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27054.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45491.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        7⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2912.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60315.exe
        6⤵
        
        PID:9636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 228
        6⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        5⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17285.exe
        6⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61070.exe
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3862.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23207.exe
        7⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 248
        7⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37433.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57730.exe
        6⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        6⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
        5⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53255.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21370.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44330.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        6⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18004.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
        5⤵
        
        PID:11428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 220
        5⤵
        Program crash
        
        PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12816.exe
        5⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
        6⤵
        
        PID:4648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 236
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        5⤵
        
        PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
      4⤵
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
        5⤵
        
        PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8440.exe
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37431.exe
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33574.exe
      4⤵
      PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
      4⤵
      PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
      4⤵
      PID:11432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20785.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56459.exe
        5⤵
        
        PID:612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 224
        6⤵
        Program crash
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52508.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53629.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6368.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
        6⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-624.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        5⤵
        
        PID:9436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 228
        5⤵
        
        PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20257.exe
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
        5⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49711.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11007.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39504.exe
        6⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        5⤵
        
        PID:5292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 224
        5⤵
        
        PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      4⤵
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55553.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63136.exe
        5⤵
        
        PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      4⤵
      PID:5556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 244
      4⤵
      PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40123.exe
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 220
        5⤵
        Program crash
        
        PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28228.exe
      4⤵
      PID:3396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 224
        5⤵
        Program crash
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5184.exe
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 236
      4⤵
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23024.exe
    3⤵
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42531.exe
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11356.exe
        5⤵
        
        PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10198.exe
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6618.exe
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4632.exe
      4⤵
      PID:11236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5005.exe
    3⤵
    PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
      4⤵
      PID:12020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13111.exe
    3⤵
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
    3⤵
    PID:8180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-782.exe
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
    3⤵
    PID:10464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        6⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240
        7⤵
        Program crash
        
        PID:2044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 236
        6⤵
        Program crash
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41772.exe
        5⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12678.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
        8⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37490.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        7⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42124.exe
        7⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 228
        7⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        6⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28237.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        6⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        7⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 244
        7⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
        6⤵
        
        PID:5020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 220
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        5⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9674.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59187.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18895.exe
        6⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63088.exe
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        5⤵
        
        PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        5⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18032.exe
        6⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46587.exe
        8⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 228
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        7⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 244
        7⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        6⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
        7⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 228
        7⤵
        Program crash
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
        6⤵
        
        PID:5072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 228
        6⤵
        Program crash
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39390.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        6⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 224
        7⤵
        Program crash
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16886.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2705.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
        6⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38264.exe
        5⤵
        
        PID:3876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 240
        6⤵
        Program crash
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48085.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        5⤵
        
        PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
      4⤵
      PID:2596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        7⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 220
        7⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        6⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        6⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24336.exe
        5⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        6⤵
        
        PID:4132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 228
        6⤵
        Program crash
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3326.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9845.exe
        5⤵
        
        PID:9888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 240
        5⤵
        
        PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54907.exe
      4⤵
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        5⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20028.exe
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        6⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
        5⤵
        
        PID:5240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 244
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
      4⤵
      PID:3912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 212
        5⤵
        
        PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
      4⤵
      PID:10880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 236
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39163.exe
        5⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        6⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48855.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        7⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        6⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
        5⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27561.exe
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42425.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        5⤵
        
        PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7045.exe
      4⤵
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        5⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        6⤵
        
        PID:5548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 248
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47147.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2342.exe
        5⤵
        
        PID:9612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 220
        5⤵
        
        PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17273.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57070.exe
        5⤵
        
        PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
      4⤵
      PID:9940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9940 -s 188
        5⤵
        
        PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
      4⤵
      PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 240
      4⤵
      Program crash
      PID:268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
    3⤵
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
      4⤵
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        5⤵
        
        PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 244
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
    3⤵
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49145.exe
      4⤵
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42451.exe
        5⤵
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47520.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exe
        5⤵
        
        PID:10604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 244
        5⤵
        
        PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50982.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      4⤵
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10257.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
      4⤵
      PID:11292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11818.exe
    3⤵
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27688.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
      4⤵
      PID:11376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
    3⤵
    PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12603.exe
    3⤵
    PID:828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52743.exe
    3⤵
    PID:10032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
    3⤵
    PID:12276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42121.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36745.exe
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62595.exe
        6⤵
        
        PID:8376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 228
        6⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40628.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
        5⤵
        
        PID:9740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 248
        5⤵
        
        PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      4⤵
      PID:3232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 240
        5⤵
        Program crash
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30946.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5934.exe
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51418.exe
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
      4⤵
      PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
    3⤵
    PID:2508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53081.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        5⤵
        
        PID:4792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 248
        5⤵
        Program crash
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32268.exe
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      4⤵
      PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16415.exe
      4⤵
      PID:11336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10194.exe
    3⤵
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 248
      4⤵
      Program crash
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64190.exe
    3⤵
    PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
    3⤵
    PID:8208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 240
    3⤵
    PID:10116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18551.exe
    3⤵
    PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50206.exe
      4⤵
      PID:3460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 220
        5⤵
        Program crash
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
      4⤵
      PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
      4⤵
      PID:9928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 228
      4⤵
      PID:12188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
    3⤵
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
      4⤵
      PID:8580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 236
      4⤵
      PID:9800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16647.exe
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 216
    3⤵
    - Program crash
    PID:5176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
  2⤵
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32718.exe
    3⤵
    PID:3952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 224
      4⤵
      PID:8932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9622.exe
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7011.exe
    3⤵
    PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26951.exe
    3⤵
    PID:10408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
  2⤵
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
    3⤵
    PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
    3⤵
    PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
    3⤵
    PID:9536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17630.exe
    3⤵
    PID:11728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
  2⤵
  PID:5136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
  2⤵
  PID:7768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
  2⤵
  PID:9400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
  2⤵
  PID:10696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe

Filesize
184KB

MD5
e176c5e06745cb5ee81d1b16c492d365

SHA1
5748d5e534641d7e99de4fbdbf96c0e373f3641b

SHA256
025ce0bfbac0f46f83f786845a8e557d383e98dc86fe984b98b1d8297345b1ab

SHA512
bc856a45c66247670ad4da60c53545fe7b4a6297a4160b9a2d59de2ddad6edd089ea5ad2a926d88bc645a4434e75a7611edde364068a7c409618a6881edee637

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe

Filesize
184KB

MD5
2910ee3b78d24d3e5707685987266c5e

SHA1
0de4427d2c0c4c403e49c4f68961a8d1240c2f48

SHA256
e20ef95110937baecb5fe82dac0263e287c2f81398eb3cfaad49e8aa12b0cd0d

SHA512
e23d89daa8fbeccbd7fb48d4a1989e18865e56705f7138d25e48b2843ad8774afd278bd8691216a893b23ea6eaae3ec5c8f5efc3f0407fd335c89cca60a379b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe

Filesize
184KB

MD5
aba6dec995a3932551d74e30b49bdbff

SHA1
2305381c920b0bf54465b452196291aa4b8cb257

SHA256
cc7051d9c6330198d98838c62e6e10c59799a142f2748d77ce837d1d4dd86f2a

SHA512
2c7f72b4314a01ebe24011388c506cde161518f7f567fe41382ac497f5125f0318bce7f0301413076e0c5e45e73f980d546c2015898943842048674e00fcd186

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe

Filesize
184KB

MD5
a665be77edf8173d016b1307810c2a48

SHA1
a36daf6cb9dd2c42d2b8fd972f255d5ff8617869

SHA256
985ebbc9349eed92560505cc9df43746d7d8e5fee908c3b7a1b19289128b6495

SHA512
4fe017b6371391a8027c97e960af14f8834235ba79f950b05360261fea473fb6a5609853ab6ba2097a44482fe66648a8dd89798e55b3a6cecc07026040134888

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13905.exe

Filesize
184KB

MD5
c70c56efce66645fb64386fb97f18fbb

SHA1
9b44d889861cc006e4c1c1b62626997817b74592

SHA256
3a5766923f65b77a7c0e59cc86ccb1cefa17b1b3904614b041df526a6bcac0e9

SHA512
8b5b5e835ec3ae437fe47fe16463dd8fa593276fbbf216cff2df94e203c145794f51294f889809c42a7f2cdd107ba555e31302d74f3057f87e191b6361920744

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16172.exe

Filesize
184KB

MD5
31f5a48642eb0ae3b55461955c37afa1

SHA1
fb7d0053629e07693033f8917739e3508c467c16

SHA256
5f3fd6c4c55ec38a88b3c4352e5ae2ac18110a75a41be5bd5c0fc0137e8de583

SHA512
c701a541c814149a686c6bf0ad355f49c5ab5e29f184f52e86fcda3a98cf2c94cc88fc9e1e161f31298788722b630ce59b4ff2d910d4c858688d64b1e717fb32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe

Filesize
184KB

MD5
416f9b5a2aa98b83190289148c73603e

SHA1
62dc88d669d67c2a6a523a846369ca460fd0317b

SHA256
2a58c786c48e255b129a16f0c3ebdb5285864261dcffebdabb58c626bd94edd6

SHA512
08a8454c2af504750cd46b26e8710edd640f3a87fae71c00da50f197b0bb2f618ba2228615591f15a383846030512035170e8a4cb7256bc27d193ee31de0bf39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe

Filesize
184KB

MD5
5d20863950f62c92629019864b05014a

SHA1
2ee20b7db05ca25d7f1cd3a89c08ac0d301d4299

SHA256
2bfab90af1ee2cb964888b2c9e025b19ad2e3089cc224528bcb3a4e44e4ee788

SHA512
acd6d3061d444e8f9e5e07a34b58058de3c9c7456fba5e549fe92ee6035bfe71871f55e1a9b0f98b2b31cf3210aea5944ffbbd809ed625af3891f40e80fc844e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19617.exe

Filesize
184KB

MD5
f347dc5ca6ec4f575d9cdaf26fddd1e3

SHA1
34ee0159e5f9e304cd0b1ee5a3ad2c0ced60562a

SHA256
36d3eea1dc1815d2de692a09706d04d683e0b0d00397e1fc3c893e5f181efe5d

SHA512
da0f20b19a68eb30400a1da47442cc38660ae6242cb36be14cdd3824a940589775ff6f5a8541ebd468328f1e1060c05bd191fe56ac43e7bf7735890453ac6a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28258.exe

Filesize
184KB

MD5
e20caf51203d3f47efb3e4fa7b5bf109

SHA1
a91e8a1cc8d78ee03285f29266c46e899449091a

SHA256
3078ba33bdc1acab20a2049346a6d70a13975a796ab6e11c5d480e2653a5f190

SHA512
96dd9f705dbec216949ac967b61de915db807cd999ec10beb02f21315a5bec3de9f4ea2968b2654e9d935dede1ae5f0d1c7764872aa3026a86f90f9c46f9a874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe

Filesize
184KB

MD5
258f3b44ee2f3385d18407dd408d851a

SHA1
faf7eb5867aa77a1a083b6e4b510f314008ca726

SHA256
6d7683610aa8e2d04b993ef55f900e9d75ca6ed27e32262238c52c20d6d10257

SHA512
31a3c9c3a1471de5d3602d3d36d5abee7c666550779501753d13201dca3332201f319e2e6ce43e91e8db222a45e85ad054cdd46f2be1b6180ec9e87cad181d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe

Filesize
184KB

MD5
c62cadd7806b49b04deefa611a1d53f9

SHA1
241f1bdfe15ca485d9688e55354de1f4f0f2a0dd

SHA256
20b57d108a5fd5b440556f9352d91e7391d4bc702721b7bd0e28791861ba4a27

SHA512
57d46846b716a901707b6495a700ea5c8f4893fbd111b2cc3b02f8a6be98c87eec240bd98bb139a3b674f4db3f6eaf7c8ab8a8b2b0945ff959a3c263dd11abe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3503.exe

Filesize
184KB

MD5
4f844265808b08a43a71e51f67ddbf56

SHA1
797f4df4e817d1c38338e88f80abc52f5469211d

SHA256
6d6b2dc2d59c15009b110fe48289fc807e45fc158e25d316b99b2ed6be2d762d

SHA512
8f1575d6ba85a90496a362d57c2bf33d213a754d51c54f295e7d734b4031b2b61fd3767a364b2fcb70cc4358f0c28f56883dca4475652986e45d59c0b2e3be8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe

Filesize
184KB

MD5
07178f28deeb6327bcf2f09d131dd9d5

SHA1
67cec832d1fd421fa81267095409d890e0f1247b

SHA256
46a214610fca3645c9396ac2b338d51896adecda660e0e52f99b4a3c694f8d9e

SHA512
f64c926e7286e6568d6b2c97052f4fb18322e8c6947b4d15094275b9f8d37dd0bcaee9b3c0294c90afeb8b64ad4834c4220d2edc4a860685b0f0d42a3a03c480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39712.exe

Filesize
184KB

MD5
5852b3ef29555fb10cf1acc728290796

SHA1
a07cecddf1629c65952ba0f99da48b4b891a6f14

SHA256
df157ee5c46f7436b001afcfa58b112afc340dae40456bb587745b5c82f0573b

SHA512
c7751b0fe5f33d22cfe96e0b40bb22c738ff3c5e1d0d59920c099c7517198f4c18d31cde2f56f113883be910f50b8cbb60bb46150610f1f8df3b3a303590a674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe

Filesize
184KB

MD5
9330c78c0df3b00f1593a6e5141ccd62

SHA1
d30f0c6492ebc851e27d66fbd37ba9f0ac978a52

SHA256
a201c50e0f169855497dd3aa2816635ae7f377b895ffe719f836eb8139103b9c

SHA512
d7f92eecb40bdedb4cf10deaab1de7da2ac448604f526714b29a78ddfac917467e5b0baab8ab78467a7de9a2a825a9b719056749cb66ed59517f9d30be931ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe

Filesize
184KB

MD5
ba9fcd8d75e6d281099e3748c12e3d5a

SHA1
d65916234c4517823150f12bb6371369491e86ae

SHA256
da2b6d39885b5d46f66c90689dce8f7cbae9120d696159b283f66cd579eb27e4

SHA512
38f5076037c66c72c8d18e75f50d6b28fbf7a16ace2309040e3335d29a877b3a4965c9708ea8165954f395a97cd1ec93c9e6f66a42b5fe714da8fb8e140325b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe

Filesize
184KB

MD5
d74dbdd3c5feb64f0cf54d59d2fd6f55

SHA1
9af677789b954e307703024a12c6a0c87e1539e9

SHA256
997c5ee2c94c187eb00c1819aa9e9310c0b91c61b6407348871b24c1238cacfa

SHA512
92b362c81cec48a8fb95d0f2cbf14640441277599cd072a4de0cdb98b052e2b4e3d6843ea370cec3659e95d9b37886da724aff94bbf62293eba8ca13e07e6a53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe

Filesize
184KB

MD5
e12f0d3e82991b25bdd268e663e31564

SHA1
78143ffb6e0da2a81271d4ff863388f8d65ba383

SHA256
08c2a23d4701fc2a5a5db5b4108f6139f5b679aadf8fb981a4bb7fd167d61a6e

SHA512
9d48ead97b322319b0127d3e47dc603c7e2f34947a45bfe3127d54b318c17c5285a695b694c5f66494ee17a8cef893f09c97a7d2aa5c39f45816e54d36a9e9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe

Filesize
184KB

MD5
90a54555b5ab4cfbfc79246ab4c7d840

SHA1
2912b0dd0f791a813e9cc804bc77142c7a9fa57f

SHA256
d65d34031b8b783dbc859b7fb2f30d9c442598903b420d38a012c57f72a4a659

SHA512
0bd2b31bde1c27019898880bb7b314f71ebbfe3a9a58495a7d6223066cf71631ca41ef87bfc572a0c06e4e5e5d99676a44312bf304553c5382aa3d8ff5f6d36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe

Filesize
184KB

MD5
22d2f018e9c9c72222b53fa8304bae43

SHA1
ad77db00024a0f98b59496fd799401ec092a33b3

SHA256
68b20685123e0870ff4782877af045e903b2591c4a29efc2617b277f6f8eb05d

SHA512
8ad3775347cfa95b6f7556c164dfe3c73186a150d25eaada93a8b284ca1da243d34834467000de72e4d0b552913fb12dffb3f7e5f20bbad428e600f176ff01bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50899.exe

Filesize
184KB

MD5
26142c86e787b3e4e9cd4d26cf657c01

SHA1
3641ec8db7aea0bb3c6c4d0e1b36e6ffd010cad9

SHA256
93d31fffff07e0053993aa798a9ea52ffa5752743b9a58c5239e195cfec44720

SHA512
8934ba9c26bd889966febb8c4ece8f65a200b90d4f69ed468ecb778cec420601f34e1bace59dea16156dd7e50d1767fdd621c6d5a96143b606655d30666d6ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52176.exe

Filesize
184KB

MD5
19a912c6c93371fc3f454e5b38e33b9d

SHA1
47604f4a30fdb5dfaec72e749ab5bfebd7ebe72e

SHA256
37bc00958ff7dd86730e87f7889d258e21a9782fb1b5f9f73811354b95d2db31

SHA512
2fa4c3adb421a2103edf2c2ab051657866696ce38a4b18bcc3dd70e91c71c1a193c9cc1846b289971a4dffc178e3acbf936814f707a0868ee499537a2124d470

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe

Filesize
184KB

MD5
5ec2d42ca521bc7fb45aa723ba66d8ce

SHA1
b6f20adf71583942e97a8b573183f17ee3d70791

SHA256
b837e673c24730682c672f5648f1fd4ec71f7c49aa660126df65747d49fd0749

SHA512
455920a27d280bd83aeea86558f02721659e8c0b1a2ba8ff41b0c3540067744f438fc7965faf99299ddff8b2a0b753215e63b229c17f0f4f8fcf0c66f1809c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe

Filesize
184KB

MD5
f1e22ab89cbbd94d6b9e73a854289feb

SHA1
415b474e36f60ca78e029af252ba8c9b238ebf47

SHA256
b72d8e5f02201484809b84c4b5ad58976f3eb9da5524eb37010e5d6a8ac2c8c3

SHA512
b7cf66d413c8b9a1413d42e949d7005c6d43df95dfd01ac925e0ec9bb8871efaafd618022ce6b81b3cc5c61d63da3e6317c6a412756f7fa85dbffff7c28059cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe

Filesize
184KB

MD5
76d4a9fc4ebdfadbfd01fe9a41e1b6c9

SHA1
cf51fc8d3b04daaba45dd59f52166d79ef48665a

SHA256
5898a1735a0f0b6aed3a558546994f214e09f784c45b94ec8dc9033177c8c26f

SHA512
2229ae42f0c309b7ea9288c0c61a5b54c424020c78d2d623f22923ddf8ae1db47e30a9458d8af4c0ea3783480cd1be4b2b08bc7d2fbb32d6bb34011c65d891af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57241.exe

Filesize
184KB

MD5
97398b7f05f802bff4ebbd6d80f4f134

SHA1
2f89c96635f9cb1b07ea8f9971ac8a7a4f054cd5

SHA256
f59c87882ba3fecd73f96d70614f0d3b38cf4503c960d20d6353242155003a82

SHA512
f95a045693faf71484ec5a37938a64fb4c8ad98f68b55597bce0f0a5290cdd993211ec52b851d3b51229191b0edb00097e65d553de513da5e1ade4625c3b7e06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe

Filesize
184KB

MD5
5b5240d40ecc82137017e370e81068bf

SHA1
dff71f3d0ba13340d67da3f6e20a367f9e5019c6

SHA256
c3b40ce90be4dfbd84b3b18fe7d4ef095ac5def5808296179a4d4eff54a34daa

SHA512
08d676db062dff4b1bc5a4b3417c388bc7db3b37209d5f3816d4436b92299009738b8b490b90b07fb91b8e24b6b7a1f9cff7823fb0f78cd81a6ce210b0f05e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6044.exe

Filesize
184KB

MD5
3ce1a5ba45ab57bd9c5d80a1c534cec6

SHA1
43b696b954a6b243938ba62b0a50b465911a797d

SHA256
6d1d98e5423ea28fc916a7dfd8c1a3c0c583a757d76de305878c24319cf51dcf

SHA512
96c9f2e1ec28e2f924bf7ba7b9c3419b34be2433cd35a1ef94a088597838e748f92dbaf47ea0c76b713d534de74540dfbefed01848be83efe956381850ea8494

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe

Filesize
184KB

MD5
05a1682431f9f78d231c4dbbb57f7645

SHA1
8fcb80dcbfff1a4640c730df96595b1c26f0c90d

SHA256
87fefe912c3a3f7ef7447cffbb4cafaa64ecd0872e863696bd606ec51695a205

SHA512
0b7e7b34502519a78e34eb7ddc69c670c5053d60649298929beba70dabaaaa508e7b663d410871448a6641fa07e1b8524bab068d37e552447ad363c50fef9b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7023.exe

Filesize
184KB

MD5
7e7803048f6eeb427e9a7ed76441454f

SHA1
ded2c750f571aa5baf553f17a721389e6bf5ebb7

SHA256
666a409713e39bff9887851251a256ad23dcec8caca14d22ea34c0dad408964c

SHA512
b8a0d9a7aaeee6cc7bb37c6052efb314f11515ec0bca8f842f5081045952e8d3bd09ded02d2cea07215ce7c3eb38b474116511d0adb688aa72e257989e9c23f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7432.exe

Filesize
184KB

MD5
677cbc16a4035b87a814a7103729f8ac

SHA1
037ed1040bda8730893483e5c06075a04753c7b3

SHA256
eeec5aa6fc2e645c7c9dc0c51fd06279392d35014cab13ec23f92c38c0d510ee

SHA512
ec92417a750b3c06de02823dce37435cd70a8518c769dadf99560c8024e682b3b39ecb9ad91db28b3b8a8836f8b8626bdc29bc94c7911afbe8f558145df72da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe

Filesize
184KB

MD5
64f3c78995e4fa0db03326acf108383f

SHA1
128e263348acfd726e2e7a23f23533db25c065e7

SHA256
7268a6c366729f0e46bb8089579a13022c0cd09eee2f21f1966b20099dd6cd14

SHA512
6d9136276ddc70678124db52de97de81092592aff9ec49359345de61bd57fe6d89d9f6a94289231772b2e0eeb6d1e08544039db5cd82a34f4edb0c0d42cac8ff

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe

Filesize
184KB

MD5
936911ac3be06af4c80aceab1b0c8160

SHA1
a0600727e6bbe990ffe375713bc4d0048f22d536

SHA256
79fecbb79be67fe6a9cea7da4020ef7c4cb75943243f992006193c9bef373ee8

SHA512
7449630314752572044c4ff54b655afadfcfd75ca2b67fcaae61114cbf30ae6a8dc8c2d397db000b6ac9942b2dca68020965e4587b11a0262700d0d2acbcc5ea

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13153.exe

Filesize
184KB

MD5
2045f16aaed405c137044dfd90ea4ca3

SHA1
6a4c3bbf26ca43a6d9dd85380601ca9306e5e07b

SHA256
76f14ce4ac6e789638c09eb344daea12b5b2ab7b07546aa4265dd13f9d973b0d

SHA512
1c576ce9bfdc29e5625f3c6fef7f736d04b7f290cb7d3854e5bd0117fb7469df06590f95b498ada5c151e324e4a110376711aeadc87c272a8b7ea41dc50012da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe

Filesize
184KB

MD5
d34dc333dd6b4603e81f306fc12cf322

SHA1
ee8ce7d34f83701283b226baae69ac2b8ed4b102

SHA256
a656409749f64240df0e796be983100bc667ec53ba4613555f21f60f890bc969

SHA512
b27b481ed425005acd89faf124ac4468eb679ad6353d6498e408d494b160261941d6577f5f2a04f3f3af5235c344cd973cd811c78c0cd343a035863cc99f33ef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe

Filesize
184KB

MD5
9bf7e0db0b43afacb0ecbd279ca3adf0

SHA1
168dec1d990f0cc99e8d34826c953fa8d0536fb5

SHA256
6b7c10f7910f149625ab22ee2c4adb4fae67404a08d560fdfe4ee531225a4c60

SHA512
eca420a53d55e8e49c36cefe5fb90d62029bf2fd0cac8eac08221e98e9642705391c6d8d5813cd24474c8607729ab35fff248a88694d7319f7fa168cea6757a2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-190.exe

Filesize
184KB

MD5
22bf44591d6b6d66ec06d47df2f6cc2e

SHA1
cd1629f9a60cdb54a424d57b5b277cedadf2da89

SHA256
9e0a024f62b997b9d11ccc83f94f31037628d7115a2cad5b9ba6e227d8603a1a

SHA512
d15fae1024828054ded8ae17a5e4c162d617ad577134a7af242fc9e275854cd5ea9625988d281e9e6d939f325b76c39ce6fbccfd6c2c387cc2e37e631ffb437d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25598.exe

Filesize
184KB

MD5
ab2e95680338f9d10d34a7ca2c7c3cc4

SHA1
5308251fc224677c256d22a3ff4e8b904affee71

SHA256
40e5f894184c7ee7e9b484f9aa8d807ca790a02c5c7ba07b66075166c2c86492

SHA512
406db706bee5716241df9f53bad5b03d2030fa1b80852ee18353a1f0484a47fd90ff988c83c990c3ced80ca991beaa9b27a5a7151c777b8aed24597103041bbc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe

Filesize
184KB

MD5
4debb5adafb17db63f8bddc74a194497

SHA1
d326be450ee1d67a7d85fa8e40e1b8b22add67c4

SHA256
173d422d226e78e50c8d28051b25798198b8d9c99b37f274fcc3a18c2e4fedd1

SHA512
7f25f59ad18ae3f0fb89e37f3a91598037e5438e2d27952bddbfa9b4d8187a0782a2c988621e3a00be2de6cb05a0d07b5cff262de495154fefca0d590c828dc0

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe

Filesize
184KB

MD5
893292819f67165444a80136f83fada1

SHA1
5fbc5533a82ee377647e94cd216c8022f68baec8

SHA256
9e9574228d448e0de85b949a71550621ee605eb99baf08e3b8e911f1a29593d9

SHA512
ce452c7cabdd394a8ae3f6b75d210f2317e5437f43075a12540cc9aba26a660fc8e82c053d1f3da19657d5142b86ede657f5e4cbc7df294d52957034e7c822f9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29682.exe

Filesize
184KB

MD5
2a22d9625b9b25c9c15b942958a9f4ce

SHA1
1f77db751733f93c9cb33cbef4967837c5dee3a6

SHA256
7525fb866a607814f63928a2e60ae35222ca3721de2aa06c8ff6e8b47214650b

SHA512
b467b749cf576d3a7db2b3d32b44c145a0b1e8966e3b0cc639bd8b034dc61031c543f31650312f8261bc8befe99da73f68a12c2833a8d6ad56fbd76031769404

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe

Filesize
184KB

MD5
153c3dd68a646d04e96260c35636affa

SHA1
f7ff24800ea992fa10c297f8e5ec53f795a802fd

SHA256
74d9f7ea0d716af6f68ac4833769018df13d9f961ce80994172f71104c6702f4

SHA512
5da8230a75fb754ba1659d20c3e7c4be3b803e70188c644515f500bac19fc48879cdfdfa26483a2b60b9348c175566ff94409695227f733ca38c244959609541

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45862.exe

Filesize
184KB

MD5
d77625c2d6f93eb02b0c42f1b29d2a44

SHA1
d5090e1bc9771d34e8fb459eada81fc000203ae3

SHA256
6e9a205be7938fa420e555a25913ac2bd73c7e2560aabbff7c1c06beffa37dda

SHA512
1b9924e5c0ba689cec0f9e788fa109adb08984051af33d1715c11fc9ddf35985ee7354031c351767d368f91895493b91e890d1dbd7b7f0bcc3dbcdf4ba976454

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe

Filesize
184KB

MD5
5328d419f1373d1c25b2ffc5d4b76d90

SHA1
1c542dda00aed598a6fd5fabbb337544f7b8d529

SHA256
4e4889240e40a33a466e36adeab0daa467ceb81e04a3433e62a9c1c6409da5a0

SHA512
8ddf070ab38e694304a232e9936fbf2bc35f03f7512bfca2fafacb44ddbec873743b86aac0d12b4f02b3ca61853d962a052d7fcaf525cf2ed4950c3053407c9a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe

Filesize
184KB

MD5
1fba4362179969f88a869835e0e7638f

SHA1
0eb37a801e25c82421da413abfa43f8b9aa4aff0

SHA256
9f00dd01fd3158a47c8fec9f28cee8658b2693cb1df68dc2f58e1654aea7148f

SHA512
a8a7b3866caf5dc89b25563a0fa7da13da13623eef39eac961a41714169d80605a1875b0f3f539715561d32f75681c1c03e1a7fe54019647eeaea3bdf40c68cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe

Filesize
184KB

MD5
3e53d599db0c57154b73e3cf3fff85f2

SHA1
32393e4bf7b2bcce67e810221ec21fd46e032898

SHA256
826ca66b2be2b78c08f0a9ef704b5fa52a4dd6ebb6df08b0ceb3474021c1634e

SHA512
9fcad0a9077fd3debe5da6481a6b5c8ac795fa9af33dfb2922f8419e676a668584c77c4e31da9ac1c893e04a9fd31d24d640985692e1b8607cb17e8e0827b550

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6661.exe

Filesize
184KB

MD5
a85a1074fa1e7e71f0fdd5b595dff3f1

SHA1
f1c101047f3b2b90e9c48d70903cf9a7ae07e434

SHA256
3d648ff06bdbc2e1bbc93b6040e0f76bb01cc1e5a58464bdb696f347cab54043

SHA512
939b5064c08c4b6360d81d137fc26344aff476f95e475abace018495e714ad3e89129401b56c049331b2bc855772238abd0074d23eb38997ee804c2cdd362db3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe

Filesize
184KB

MD5
d1e21f6d63ecdc2c78f6effad78320ef

SHA1
2359b94b2ce6e7e49f5f9815fa8ee281eac42191

SHA256
fd780d69443d1dddabda5d7e26493a5e4966235bc964fbe9eec7a4e99dd11baa

SHA512
71a29bc917eb5bfb6a84fafd6a43d0b97e491b6029de363d2ace1654316a411307edfb02f3a4d6fc305cfaa91ea000f06c98edf561534d23f7991ae2832bbb1d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe

Filesize
184KB

MD5
91ff0838fdb9bbd8c25ae3e5bc023679

SHA1
52ae102234ba8fc1c572ed028b13e4e17bf74d5c

SHA256
0c8c0b5fd918a37aba6219bdfb46827d2aa3eadf4e9764ec18fc795267730eb0

SHA512
5ea689152fbb6b3a7a473786775ccf1f658db6f1b39acff75aa85f0972c10cb991e9ffeed9535e396a86e2eec69ee931e3930441c230364265ec1fc236d1336a

Download Submit
memory/1060-1023-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2584-628-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2624-473-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/14176-6697-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads