212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
Size

468KB
MD5

7046763129cb9d7dc1a2391f27330ec7
SHA1

f90bf8693b0d3a14e935131f050d6a7b99a0c214
SHA256

212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c
SHA512

0595bd7a3654470540485d3d7e6af9652f03e7f84dd074b14d2c02e4c289aea6dde5495ab8ab47f0fab57715f265bd40098046abfeac89e1f14c777bb312baca
SSDEEP

3072:cMFCoou+ny8UBbYIPzGjofrVChjWFpPQmHe4y/N48wF6dONYDlF:cMAo+LUB3PSjofhDqR48gyONY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2420	Unicorn-37168.exe
2112	Unicorn-6524.exe
2796	Unicorn-24484.exe
2888	Unicorn-59342.exe
2872	Unicorn-54703.exe
1884	Unicorn-11624.exe
2724	Unicorn-13670.exe
1712	Unicorn-24060.exe
1940	Unicorn-9669.exe
1704	Unicorn-3539.exe
1392	Unicorn-55097.exe
2440	Unicorn-55362.exe
1644	Unicorn-6161.exe
2004	Unicorn-17022.exe
2236	Unicorn-36094.exe
3032	Unicorn-27411.exe
1908	Unicorn-23650.exe
1708	Unicorn-21818.exe
2444	Unicorn-30749.exe
1664	Unicorn-24262.exe
2272	Unicorn-59337.exe
1668	Unicorn-29933.exe
1992	Unicorn-46270.exe
2144	Unicorn-598.exe
880	Unicorn-39493.exe
2460	Unicorn-7375.exe
2108	Unicorn-31325.exe
1272	Unicorn-16834.exe
280	Unicorn-28009.exe
2044	Unicorn-1921.exe
2732	Unicorn-64765.exe
2744	Unicorn-33938.exe
2800	Unicorn-58543.exe
2260	Unicorn-63182.exe
1920	Unicorn-25485.exe
2176	Unicorn-60489.exe
2844	Unicorn-20225.exe
1876	Unicorn-20587.exe
1896	Unicorn-13810.exe
1508	Unicorn-64195.exe
2864	Unicorn-60572.exe
2072	Unicorn-34898.exe
804	Unicorn-61127.exe
408	Unicorn-61127.exe
1524	Unicorn-56031.exe
1804	Unicorn-56296.exe
1088	Unicorn-56296.exe
2496	Unicorn-13872.exe
1988	Unicorn-52112.exe
1976	Unicorn-15263.exe
2020	Unicorn-27516.exe
2052	Unicorn-5512.exe
308	Unicorn-41806.exe
2696	Unicorn-25954.exe
856	Unicorn-49067.exe
1864	Unicorn-60764.exe
2892	Unicorn-5341.exe
2988	Unicorn-64748.exe
2904	Unicorn-65159.exe
2672	Unicorn-34698.exe
2852	Unicorn-37198.exe
2148	Unicorn-38590.exe
2000	Unicorn-57619.exe
1756	Unicorn-5725.exe

Loads dropped DLL 64 IoCs

pid	Process
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2420	Unicorn-37168.exe
2420	Unicorn-37168.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2112	Unicorn-6524.exe
2112	Unicorn-6524.exe
2420	Unicorn-37168.exe
2420	Unicorn-37168.exe
2796	Unicorn-24484.exe
2796	Unicorn-24484.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2888	Unicorn-59342.exe
2888	Unicorn-59342.exe
1884	Unicorn-11624.exe
1884	Unicorn-11624.exe
2420	Unicorn-37168.exe
2420	Unicorn-37168.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2872	Unicorn-54703.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2872	Unicorn-54703.exe
2724	Unicorn-13670.exe
2724	Unicorn-13670.exe
2796	Unicorn-24484.exe
2796	Unicorn-24484.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
2664	WerFault.exe
1940	Unicorn-9669.exe
1940	Unicorn-9669.exe
1884	Unicorn-11624.exe
1884	Unicorn-11624.exe
1392	Unicorn-55097.exe
1392	Unicorn-55097.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
1704	Unicorn-3539.exe
1704	Unicorn-3539.exe
2420	Unicorn-37168.exe
2420	Unicorn-37168.exe
1644	Unicorn-6161.exe
1644	Unicorn-6161.exe
2724	Unicorn-13670.exe
2724	Unicorn-13670.exe
2440	Unicorn-55362.exe
2872	Unicorn-54703.exe
2872	Unicorn-54703.exe
2440	Unicorn-55362.exe
1712	Unicorn-24060.exe
2888	Unicorn-59342.exe
1712	Unicorn-24060.exe
2888	Unicorn-59342.exe
2004	Unicorn-17022.exe
2004	Unicorn-17022.exe
2796	Unicorn-24484.exe
2796	Unicorn-24484.exe
2236	Unicorn-36094.exe
2236	Unicorn-36094.exe
1940	Unicorn-9669.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2664	2112	WerFault.exe	32
2856	2108	WerFault.exe	58
2192	2460	WerFault.exe	57
444	1272	WerFault.exe	59
1252	2004	WerFault.exe	45
2208	2864	WerFault.exe	74
1160	1804	WerFault.exe	82
2188	804	WerFault.exe	125
484	708	WerFault.exe	120
1900	2612	WerFault.exe	111
3496	2440	WerFault.exe	42
3676	1896	WerFault.exe	70
3820	2196	WerFault.exe	123
3976	2672	WerFault.exe	95
3260	2840	WerFault.exe	100
4164	1088	WerFault.exe	81
4576	1756	WerFault.exe	99
4588	1976	WerFault.exe	85
4680	308	WerFault.exe	88
4972	2632	WerFault.exe	113
4992	1864	WerFault.exe	91
5008	1520	WerFault.exe	127
4952	1324	WerFault.exe	103
5676	2904	WerFault.exe	94
5640	1680	WerFault.exe	154
5624	2096	WerFault.exe	147
5264	2888	WerFault.exe	35
5248	1072	WerFault.exe	122
7076	2008	WerFault.exe	104
6836	1048	WerFault.exe	117
6840	2496	WerFault.exe	83
6856	1692	WerFault.exe	126
6868	1524	WerFault.exe	80
6872	2332	WerFault.exe	107
7072	2052	WerFault.exe	87
6988	2044	WerFault.exe	61
6968	2872	WerFault.exe	34
6960	1396	WerFault.exe	115
6948	2300	WerFault.exe	162
6920	3144	WerFault.exe	197
6904	2752	WerFault.exe	109
6576	572	WerFault.exe	116
6560	988	WerFault.exe	118
6372	1684	WerFault.exe	131
6716	2696	WerFault.exe	89
1440	1920	WerFault.exe	67
7264	2680	WerFault.exe	158
7284	2216	WerFault.exe	141
7292	1928	WerFault.exe	129
7364	2356	WerFault.exe	139
7416	2540	WerFault.exe	132
7404	2812	WerFault.exe	134
7396	2668	WerFault.exe	136
7384	1740	WerFault.exe	130
8840	1420	WerFault.exe	186
8828	3096	WerFault.exe	196
8816	992	WerFault.exe	194
9024	2572	WerFault.exe	146
9204	1744	WerFault.exe	182
8152	2260	WerFault.exe	65
8860	2468	WerFault.exe	178
9220	2736	WerFault.exe	133
9320	408	WerFault.exe	76
9328	2892	WerFault.exe	93

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
2420	Unicorn-37168.exe
2112	Unicorn-6524.exe
2796	Unicorn-24484.exe
2888	Unicorn-59342.exe
2872	Unicorn-54703.exe
1884	Unicorn-11624.exe
2724	Unicorn-13670.exe
1712	Unicorn-24060.exe
1940	Unicorn-9669.exe
1392	Unicorn-55097.exe
1704	Unicorn-3539.exe
2440	Unicorn-55362.exe
1644	Unicorn-6161.exe
2004	Unicorn-17022.exe
2236	Unicorn-36094.exe
3032	Unicorn-27411.exe
1908	Unicorn-23650.exe
1708	Unicorn-21818.exe
2444	Unicorn-30749.exe
1664	Unicorn-24262.exe
2272	Unicorn-59337.exe
2460	Unicorn-7375.exe
880	Unicorn-39493.exe
1992	Unicorn-46270.exe
1668	Unicorn-29933.exe
1272	Unicorn-16834.exe
2144	Unicorn-598.exe
2108	Unicorn-31325.exe
280	Unicorn-28009.exe
2044	Unicorn-1921.exe
2732	Unicorn-64765.exe
2744	Unicorn-33938.exe
2800	Unicorn-58543.exe
2260	Unicorn-63182.exe
1920	Unicorn-25485.exe
2176	Unicorn-60489.exe
2844	Unicorn-20225.exe
1876	Unicorn-20587.exe
1508	Unicorn-64195.exe
2864	Unicorn-60572.exe
1896	Unicorn-13810.exe
2072	Unicorn-34898.exe
408	Unicorn-61127.exe
1804	Unicorn-56296.exe
1524	Unicorn-56031.exe
1088	Unicorn-56296.exe
2496	Unicorn-13872.exe
1988	Unicorn-52112.exe
1976	Unicorn-15263.exe
2020	Unicorn-27516.exe
2052	Unicorn-5512.exe
308	Unicorn-41806.exe
2696	Unicorn-25954.exe
856	Unicorn-49067.exe
1864	Unicorn-60764.exe
2892	Unicorn-5341.exe
2988	Unicorn-64748.exe
2904	Unicorn-65159.exe
2672	Unicorn-34698.exe
2852	Unicorn-37198.exe
2148	Unicorn-38590.exe
2000	Unicorn-57619.exe
1756	Unicorn-5725.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2420	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	31
PID 2404 wrote to memory of 2420	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	31
PID 2404 wrote to memory of 2420	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	31
PID 2404 wrote to memory of 2420	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	31
PID 2420 wrote to memory of 2112	2420	Unicorn-37168.exe	32
PID 2420 wrote to memory of 2112	2420	Unicorn-37168.exe	32
PID 2420 wrote to memory of 2112	2420	Unicorn-37168.exe	32
PID 2420 wrote to memory of 2112	2420	Unicorn-37168.exe	32
PID 2404 wrote to memory of 2796	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	33
PID 2404 wrote to memory of 2796	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	33
PID 2404 wrote to memory of 2796	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	33
PID 2404 wrote to memory of 2796	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	33
PID 2112 wrote to memory of 2872	2112	Unicorn-6524.exe	34
PID 2112 wrote to memory of 2872	2112	Unicorn-6524.exe	34
PID 2112 wrote to memory of 2872	2112	Unicorn-6524.exe	34
PID 2112 wrote to memory of 2872	2112	Unicorn-6524.exe	34
PID 2420 wrote to memory of 2888	2420	Unicorn-37168.exe	35
PID 2420 wrote to memory of 2888	2420	Unicorn-37168.exe	35
PID 2420 wrote to memory of 2888	2420	Unicorn-37168.exe	35
PID 2420 wrote to memory of 2888	2420	Unicorn-37168.exe	35
PID 2796 wrote to memory of 2724	2796	Unicorn-24484.exe	36
PID 2796 wrote to memory of 2724	2796	Unicorn-24484.exe	36
PID 2796 wrote to memory of 2724	2796	Unicorn-24484.exe	36
PID 2796 wrote to memory of 2724	2796	Unicorn-24484.exe	36
PID 2404 wrote to memory of 1884	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	37
PID 2404 wrote to memory of 1884	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	37
PID 2404 wrote to memory of 1884	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	37
PID 2404 wrote to memory of 1884	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	37
PID 2888 wrote to memory of 1712	2888	Unicorn-59342.exe	38
PID 2888 wrote to memory of 1712	2888	Unicorn-59342.exe	38
PID 2888 wrote to memory of 1712	2888	Unicorn-59342.exe	38
PID 2888 wrote to memory of 1712	2888	Unicorn-59342.exe	38
PID 1884 wrote to memory of 1940	1884	Unicorn-11624.exe	39
PID 1884 wrote to memory of 1940	1884	Unicorn-11624.exe	39
PID 1884 wrote to memory of 1940	1884	Unicorn-11624.exe	39
PID 1884 wrote to memory of 1940	1884	Unicorn-11624.exe	39
PID 2420 wrote to memory of 1704	2420	Unicorn-37168.exe	40
PID 2420 wrote to memory of 1704	2420	Unicorn-37168.exe	40
PID 2420 wrote to memory of 1704	2420	Unicorn-37168.exe	40
PID 2420 wrote to memory of 1704	2420	Unicorn-37168.exe	40
PID 2404 wrote to memory of 1392	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	41
PID 2404 wrote to memory of 1392	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	41
PID 2404 wrote to memory of 1392	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	41
PID 2404 wrote to memory of 1392	2404	212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe	41
PID 2872 wrote to memory of 2440	2872	Unicorn-54703.exe	42
PID 2872 wrote to memory of 2440	2872	Unicorn-54703.exe	42
PID 2872 wrote to memory of 2440	2872	Unicorn-54703.exe	42
PID 2872 wrote to memory of 2440	2872	Unicorn-54703.exe	42
PID 2112 wrote to memory of 2664	2112	Unicorn-6524.exe	43
PID 2112 wrote to memory of 2664	2112	Unicorn-6524.exe	43
PID 2112 wrote to memory of 2664	2112	Unicorn-6524.exe	43
PID 2112 wrote to memory of 2664	2112	Unicorn-6524.exe	43
PID 2724 wrote to memory of 1644	2724	Unicorn-13670.exe	44
PID 2724 wrote to memory of 1644	2724	Unicorn-13670.exe	44
PID 2724 wrote to memory of 1644	2724	Unicorn-13670.exe	44
PID 2724 wrote to memory of 1644	2724	Unicorn-13670.exe	44
PID 2796 wrote to memory of 2004	2796	Unicorn-24484.exe	45
PID 2796 wrote to memory of 2004	2796	Unicorn-24484.exe	45
PID 2796 wrote to memory of 2004	2796	Unicorn-24484.exe	45
PID 2796 wrote to memory of 2004	2796	Unicorn-24484.exe	45
PID 1940 wrote to memory of 2236	1940	Unicorn-9669.exe	46
PID 1940 wrote to memory of 2236	1940	Unicorn-9669.exe	46
PID 1940 wrote to memory of 2236	1940	Unicorn-9669.exe	46
PID 1940 wrote to memory of 2236	1940	Unicorn-9669.exe	46

C:\Users\Admin\AppData\Local\Temp\212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe
"C:\Users\Admin\AppData\Local\Temp\212cad439dfb521becbba80f5897e192565012f7e5d2c93cacd2a176afb5592c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-598.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32991.exe
        8⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        9⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        9⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        9⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 216
        9⤵
        Program crash
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        9⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 240
        8⤵
        Program crash
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34121.exe
        7⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        8⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        8⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 216
        8⤵
        Program crash
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-575.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exe
        7⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
        8⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 216
        8⤵
        Program crash
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        8⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16398.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 220
        7⤵
        Program crash
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        6⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        7⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 236
        7⤵
        Program crash
        
        PID:6560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 236
        6⤵
        Program crash
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27516.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
        8⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        8⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
        7⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 236
        7⤵
        Program crash
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        6⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6919.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        7⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14189.exe
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        7⤵
        
        PID:10428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 220
        6⤵
        Program crash
        
        PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54324.exe
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        6⤵
        
        PID:3804
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 236
        6⤵
        Program crash
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39999.exe
        6⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        5⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 236
        5⤵
        Program crash
        
        PID:6968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 236
      4⤵
      Loads dropped DLL
      Program crash
      PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 240
        7⤵
        Program crash
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44319.exe
        6⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        7⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        8⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        7⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 220
        7⤵
        Program crash
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12226.exe
        6⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7345.exe
        7⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 216
        7⤵
        Program crash
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7060.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        6⤵
        
        PID:9180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 240
        6⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        7⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10956.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 240
        6⤵
        Program crash
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60195.exe
        6⤵
        
        PID:8196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 216
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32248.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        5⤵
        
        PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 220
        5⤵
        Program crash
        
        PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47381.exe
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1657.exe
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 236
        7⤵
        Program crash
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34610.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        6⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59477.exe
        5⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6395.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        6⤵
        
        PID:9404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 220
        6⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
        5⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        5⤵
        
        PID:9460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 240
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
      4⤵
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        5⤵
        
        PID:3080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 236
        5⤵
        Program crash
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
      4⤵
      PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
      4⤵
      PID:5016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 240
      4⤵
      Program crash
      PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3539.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20225.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        6⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        7⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        8⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51786.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        8⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 220
        8⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18247.exe
        7⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 240
        7⤵
        Program crash
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        6⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17278.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13613.exe
        7⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        6⤵
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        6⤵
        
        PID:9444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 240
        6⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        6⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        7⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 236
        7⤵
        Program crash
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        6⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32851.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        6⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29981.exe
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        5⤵
        
        PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        5⤵
        
        PID:708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 220
        6⤵
        Program crash
        
        PID:484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        6⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22681.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        6⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59476.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30116.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64616.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60725.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44137.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53379.exe
        5⤵
        
        PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      4⤵
      PID:804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 220
        5⤵
        Program crash
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56831.exe
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60447.exe
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19881.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        5⤵
        
        PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      4⤵
      PID:10692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
      4⤵
      PID:11320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28959.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        6⤵
        
        PID:10168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 220
        6⤵
        
        PID:11104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 236
        5⤵
        Program crash
        
        PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38362.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25743.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        5⤵
        
        PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
      4⤵
      PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
      4⤵
      PID:9468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 240
      4⤵
      PID:10812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3826.exe
      4⤵
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18357.exe
        5⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24250.exe
        5⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        5⤵
        
        PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8702.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        5⤵
        
        PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47533.exe
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
      4⤵
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
      4⤵
      PID:10604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
    3⤵
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22358.exe
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61294.exe
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        5⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65133.exe
        5⤵
        
        PID:8984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 216
        5⤵
        
        PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12792.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48768.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22606.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
      4⤵
      PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
      4⤵
      PID:10360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
    3⤵
    PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5585.exe
    3⤵
    PID:7808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
    3⤵
    PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
    3⤵
    PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51979.exe
    3⤵
    PID:10964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        7⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 240
        8⤵
        Program crash
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        8⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 220
        8⤵
        Program crash
        
        PID:8828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 240
        7⤵
        Program crash
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        6⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        7⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23582.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46080.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        7⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        6⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        6⤵
        
        PID:10652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 240
        6⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46805.exe
        6⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17231.exe
        7⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        8⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6234.exe
        7⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 240
        7⤵
        Program crash
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6109.exe
        6⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 216
        7⤵
        Program crash
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        6⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 236
        6⤵
        Program crash
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63233.exe
        5⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        6⤵
        
        PID:2120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 236
        6⤵
        Program crash
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        5⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
        6⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8134.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48063.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26994.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19744.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        5⤵
        
        PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51766.exe
        6⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        7⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64667.exe
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65212.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41242.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        7⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:10984
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 236
        6⤵
        Program crash
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        6⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29544.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        6⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        5⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59211.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        6⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16799.exe
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50753.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        5⤵
        
        PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52112.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        6⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7926.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        7⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        6⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        6⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
        6⤵
        
        PID:8896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 216
        6⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57639.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        5⤵
        
        PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35248.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        5⤵
        
        PID:6152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 216
        5⤵
        Program crash
        
        PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
      4⤵
      PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
      4⤵
      PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26532.exe
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15582.exe
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
      4⤵
      PID:10368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 240
        5⤵
        Program crash
        
        PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
      4⤵
      Executes dropped EXE
      PID:804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 220
      4⤵
      Program crash
      PID:1252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 240
      4⤵
      Program crash
      PID:444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56031.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        6⤵
        
        PID:5780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 236
        6⤵
        Program crash
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2020.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        5⤵
        
        PID:5228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 240
        5⤵
        Program crash
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23623.exe
      4⤵
      PID:2540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        5⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        5⤵
        
        PID:6160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 216
        5⤵
        Program crash
        
        PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      4⤵
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
      4⤵
      PID:5296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 236
      4⤵
      Program crash
      PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
    3⤵
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17598.exe
        5⤵
        
        PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-369.exe
      4⤵
      PID:5604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 236
      4⤵
      Program crash
      PID:6904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
    3⤵
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25478.exe
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15770.exe
      4⤵
      PID:10608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8664.exe
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42105.exe
    3⤵
    PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21197.exe
    3⤵
    PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19782.exe
    3⤵
    PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
    3⤵
    PID:8440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
    3⤵
    PID:9852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    3⤵
    PID:10780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        7⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53079.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        8⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        7⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 240
        7⤵
        Program crash
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        6⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7770.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11226.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33880.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        7⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        6⤵
        
        PID:9396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 240
        6⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19260.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        7⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        7⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 240
        7⤵
        Program crash
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        6⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
        5⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14926.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        6⤵
        
        PID:8796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 236
        6⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18304.exe
        5⤵
        
        PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        5⤵
        
        PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
        5⤵
        
        PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-510.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        7⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 236
        7⤵
        Program crash
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
        6⤵
        
        PID:3920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 240
        6⤵
        Program crash
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16031.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        6⤵
        
        PID:6192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 236
        6⤵
        Program crash
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        5⤵
        
        PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63106.exe
        5⤵
        
        PID:5760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 236
        5⤵
        Program crash
        
        PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22929.exe
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        6⤵
        
        PID:8328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 236
        6⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        5⤵
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        5⤵
        
        PID:8412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240
        5⤵
        
        PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
      4⤵
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        5⤵
        
        PID:6928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 220
        5⤵
        Program crash
        
        PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21865.exe
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4915.exe
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17592.exe
      4⤵
      PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        6⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        7⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 216
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        6⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61423.exe
        5⤵
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9140.exe
        6⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38917.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46929.exe
        6⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33026.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        5⤵
        
        PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        5⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        6⤵
        
        PID:7888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 240
        6⤵
        Program crash
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55457.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        5⤵
        
        PID:8340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 240
        5⤵
        
        PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45762.exe
        5⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        5⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17876.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        5⤵
        
        PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
      4⤵
      PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
      4⤵
      PID:10972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57433.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38732.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
        6⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63665.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        5⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        5⤵
        
        PID:8592
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 240
        5⤵
        Program crash
        
        PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
      4⤵
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64122.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        5⤵
        
        PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38803.exe
      4⤵
      PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51501.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13079.exe
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
      4⤵
      PID:11304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16219.exe
      4⤵
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        5⤵
        
        PID:5800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 220
        5⤵
        Program crash
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45741.exe
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 240
      4⤵
      Program crash
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49883.exe
    3⤵
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
      4⤵
      PID:10940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5330.exe
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21980.exe
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
    3⤵
    PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18815.exe
    3⤵
    PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
    3⤵
    PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50077.exe
    3⤵
    PID:9816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
    3⤵
    PID:10392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        6⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19027.exe
        7⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        7⤵
        
        PID:11076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 236
        6⤵
        Program crash
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8175.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10805.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        6⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        5⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32232.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        5⤵
        
        PID:10132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 240
        5⤵
        
        PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58813.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44024.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54745.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42279.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24176.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10930.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9860.exe
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43659.exe
        5⤵
        
        PID:8144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 220
        5⤵
        
        PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28754.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-495.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61384.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        5⤵
        
        PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48080.exe
      4⤵
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
      4⤵
      PID:10380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28824.exe
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56250.exe
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33255.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        6⤵
        
        PID:10092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 220
        6⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        5⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 216
        5⤵
        Program crash
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      4⤵
      PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        5⤵
        
        PID:8008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 220
        5⤵
        Program crash
        
        PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
      4⤵
      PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
      4⤵
      PID:7932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 240
      4⤵
      Program crash
      PID:8152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16471.exe
    3⤵
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        5⤵
        
        PID:8664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 220
        5⤵
        
        PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
      4⤵
      PID:11000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46789.exe
    3⤵
    PID:784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3738.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53681.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5461.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63180.exe
      4⤵
      PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1158.exe
    3⤵
    PID:4236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
    3⤵
    PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    3⤵
    PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50631.exe
    3⤵
    PID:8492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
    3⤵
    PID:9240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
    3⤵
    PID:10664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65395.exe
    3⤵
    PID:11328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1641.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1712.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        6⤵
        
        PID:11032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 236
        5⤵
        Program crash
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56161.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        5⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37832.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26347.exe
        5⤵
        
        PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49663.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25913.exe
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38921.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
      4⤵
      PID:8320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 236
      4⤵
      PID:9992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27432.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
      4⤵
      PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25067.exe
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27645.exe
        5⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33396.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62333.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48602.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        5⤵
        
        PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54148.exe
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
      4⤵
      PID:11488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48132.exe
    3⤵
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30796.exe
      4⤵
      PID:4112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 236
      4⤵
      Program crash
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
    3⤵
    PID:3576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3029.exe
    3⤵
    PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55966.exe
    3⤵
    PID:8480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7744.exe
    3⤵
    PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16251.exe
    3⤵
    PID:10620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18059.exe
    3⤵
    PID:11312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
      4⤵
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        5⤵
        
        PID:5116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 240
        5⤵
        Program crash
        
        PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24841.exe
        5⤵
        
        PID:10556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 240
      4⤵
      Program crash
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
    3⤵
    PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        5⤵
        
        PID:5856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 220
        5⤵
        Program crash
        
        PID:6948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 216
      4⤵
      Program crash
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
    3⤵
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-972.exe
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47951.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3323.exe
      4⤵
      PID:8360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 220
      4⤵
      PID:10020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60982.exe
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17693.exe
    3⤵
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 240
    3⤵
    - Program crash
    PID:1440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
  2⤵
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50946.exe
    3⤵
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2394.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63881.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53265.exe
      4⤵
      PID:10448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5201.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
    3⤵
    PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
    3⤵
    PID:8864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
    3⤵
    PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
    3⤵
    PID:10476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46095.exe
  2⤵
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
    3⤵
    PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
    3⤵
    PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16508.exe
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45023.exe
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
    3⤵
    PID:11028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55337.exe
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
  2⤵
  PID:4804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41579.exe
  2⤵
  PID:7048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
  2⤵
  PID:7956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52640.exe
  2⤵
  PID:8268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
  2⤵
  PID:10012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
  2⤵
  PID:11040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11624.exe

Filesize
468KB

MD5
331bf86eb305910cea25583f81482e7c

SHA1
99349f05cb3e643367d30219bbf57e4f11909b11

SHA256
f9718062b19cef44414186f4f6707b192404d3c0d0bc888de7ca5edbe9e4fefe

SHA512
a1d068be86995b520b5348c18b5ac8530fad33cb906123bfb3349905d9ac89a0db6a39ea208c952c6d12042f3ec929e8f58397c0040a2ddef9309be5da0f1936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe

Filesize
468KB

MD5
da42caecfb54dac25da23ff56dd7041b

SHA1
314b70a232e87620bf5bd5b685039f3417d52adc

SHA256
a41fab247501926392f165796d6a4426ab7d99e49b8c22a219f47441759a0be6

SHA512
0d40ea5a25525546f9f83a0ec6e3005d18d5dd52c975f407fa0a2b6762e8fd88ce2c2d3a9391dc7b13beefea49c11ac360ccb28ecb8ee5a35265b8a585272e85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3539.exe

Filesize
468KB

MD5
12292a303ec0e3bc59ff1e78c33a89f4

SHA1
38381f2aa32258dfc79a8b1f3fe51c84ff7e515d

SHA256
12061d8b1c1688e2e4321256b75ca53f884389039cabb07d4c8d1867f8ea595f

SHA512
4b30ba666b189101f92abf3ac89af27f2c36bdbbccafd09e07f1b08ac527c2f2f5e3ab3575b94d24be950692eead3f661d5b97684bfbf946dce849b14c12c737

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5201.exe

Filesize
468KB

MD5
89371925605eaa24501a6b414c35c3e9

SHA1
bc212c2951dd684a98b6c334be77d92bb6e3a16c

SHA256
d34f24bee56589624eecc187d36f6b5f5f7adcebcc38216143fd284b15fd234f

SHA512
01dc1c3cc5e1fd0162fb001334c982c9ef1f9a59d02f9047e69b0e296197fee2df8bd39e952e326ba58ed9ddf2952c20496b7bab17b45b68f9e233fa2dbb46fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe

Filesize
468KB

MD5
10b2776caab2366a1e7857cb143c847c

SHA1
01c6b0666be302435642846231eced28b67c7625

SHA256
ec074cf2e224e039a6433264d792053d1dd7b4069c264a3798afef087267139b

SHA512
b168dad3abac3ddb939006c51d83419eb289a037146dcfff2473b66014951133cb5534c22b380c5e788948644b7ac9d695c7989ea5f2a993cad576506e721554

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6161.exe

Filesize
468KB

MD5
ca4c2a537f67e19f9e1c46db239fb455

SHA1
3cf7152927320a2f0c3132c6157cd6dc37cc7c39

SHA256
4a8a9d205d0cacb31752f24e8dfee5d558bfa1bdaabc49688333258b3cd10382

SHA512
12a7f71f802cb276e93d8fb6ea53a94c9c13d8c9c0d8d9bab2adba563eb43d95fcc20dbef720f2711bfb6d6b7bf1bae3b98cec1fc6140c56e686b9cb900acd1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe

Filesize
468KB

MD5
f88a3c594620739bc1d3c18cfbb9ad53

SHA1
f5212af0e8d02ffbe4129c2916687eeb30a5673c

SHA256
cb1dd48130d535cb3a2ae5ab305a66cc38bf0edfc946c719afc41768868853f7

SHA512
88ba974064f365c36a6bf26e10d876cbe93943259d6c4c321d2feda360c869d070124578c58d394b1568c383e9a68544a4823ba2339142e383c7c72971f17e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe

Filesize
468KB

MD5
68605ad80f9e79ea968b7be307c28a52

SHA1
b3205bda04c468c1e32776c74b5d862638e806ec

SHA256
5bc0f7b1d7e39d3ae94a1b3dc11746a1550030545802f22395201a240097882c

SHA512
ebc83e84ca4be811f33be7a700c04d75e1fc3607797304c03c072043faafa915faeed5ba9112f609f3d269ee5bd29eb50ff0ad1a3f89e0569238c05383db683e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13670.exe

Filesize
468KB

MD5
8c1bcc0d055f6385b3bbfe0ab4e69011

SHA1
094e52f11fea10df71a4a09e3dc9a4c017f81ef6

SHA256
11402a5f66d846a4fb0384772e35bfb26f628d6fad21ee681380de6574f1b60e

SHA512
815c10d4527aa70a3e5d6c9ef23dec22ea05048c050155f5ccd6728340fa9304f1a221b3b1b541a7788d2e9063c98459760bf145816a007c2f00cf1b436656b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe

Filesize
468KB

MD5
22c72cb791d64ba8d7fe2d7c50d8c99b

SHA1
fc8d7a5587f7b392bf0e231b3500f685783bdcf7

SHA256
3b3cb46d8d36d2bc75ee21228eb805c65e49d26f802e7c849e1aa5ad5c31ab38

SHA512
40ef12b77db766d8fb31b3b3da7ee4d77eca1476bf947e106532632ba5c9347d9eb33437fcdac6ad0d07c570a1cb7bbb6e452f35d0022e59964779d146c4b90f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-23650.exe

Filesize
468KB

MD5
77040f72e633aff11489527eb09327c5

SHA1
5899d5faee28396662bc94459ba93fa13c1af795

SHA256
be6b2512a1af0048fd7d98a53179289c50449bfcea961375e36753a1a44a0121

SHA512
18e24fa3b43f243a18e22adf9297e5af751c61828a6323c525509853a1ab7466f5374d01338065ee432fb92a84d4db99645a72f38bb234d41a73eda30d239648

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24060.exe

Filesize
468KB

MD5
207dd5dbd073cc2d354809f9b83e7d56

SHA1
8bf12615b080c30d1033f17d6f98a8bf6aa8dea7

SHA256
f746c01551e11a7f29193a81828d7181624ba0f4156a841e0f2b7886baee8a5d

SHA512
38ec66a2575b8803e0161271dbbe77ca477be185f1c700ad039c88a3a78473d89b1411e5cd230ff1b7365ed6d8068df950dc0385da5228e64b79eeb3700bf929

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27411.exe

Filesize
468KB

MD5
fc24c420fb8d4ec21b6adfbebd2a1401

SHA1
591971e16be1ea79dd253022b5a927028292c24a

SHA256
4bb80a8cb8b9a568a0802f1696d0263ae1e1cc83076dd4793dd18fbd215b4a90

SHA512
e6040116c4388b57004619aaf27890add1919500a6471ef00e87929b0c107e4398ba69c833a6f5cdf53fe40cd7d35390119fda96cef4fe4a4857742e9589281b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36094.exe

Filesize
468KB

MD5
5fafc12c81688a49ad61f61d9f1b03fb

SHA1
db1591243462a68f05033889bbabec6a19051910

SHA256
c455c7a933c6fe9b70aeba04f37b35f77f2eff3fd4818d5bd10c495335357a45

SHA512
0c78e51f14dbdeba71c2d12c2f263370740d0dae1efc7d22a8b278e420feeabf497b472fce7fa253b999b30731b997aa9b1869c1655b08d9cf088f6c3e63c409

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe

Filesize
468KB

MD5
6c06fd35c6722ad19631835a9cf41ad5

SHA1
c85e9c09adfe29d968bc9328af51ca7a091c1c7b

SHA256
93f5d7c8c82ee4c366852947d73e29e3aef1ac25c0af072fd6455ee55d6e5ba2

SHA512
96d24f17850a8000535fd3b97a1e27bb2203a8f285c8a8a7d279fd6f4dfcf9a343b06d5f787c3e8f15d705988ffd59cea6897a20153d45cc6f7c1080c6a70ddb

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe

Filesize
468KB

MD5
3870b60cbc6fea319494f05b371ff2b5

SHA1
c6bdb256406045b2d8528fe524df7e6f0a0fbf1a

SHA256
7595658261670e6c38489c6b1e0a51b411ceb405642a2bb28f8f6fc9a0eabb0c

SHA512
97602970a8870d8c24045557d7bb7d9ed2c33e39abfdfe1ca455a54c7482c60343312e3008c7b9908dcd16d84b495f6ff7bd907e95a6d261bbd110570e94128c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe

Filesize
468KB

MD5
c525bd80face32d770a814a54d994c1c

SHA1
054e6c03c07b12d6dfeba2be5e47d944d8956f8c

SHA256
82343e3612846e65e8ba5a168064b9ef5d51d3a52c4a38adf816c77f6da3f78a

SHA512
80668c3b25052b6442f6ce1ddeb59a758661998fcff68bc1b0a0cf114d5551de8db2d39b9c30298a44846892431a971050a1d3c7dabbe3372ca624c9f61287a4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe

Filesize
468KB

MD5
34b4293f45a7183de1a10952787c6cf6

SHA1
07c780a8efe3992e6740fb01d3a4508192c21cae

SHA256
2a27f29e7b0d09c3509c7756dcc6166bb786d09c7f5ca1b7a982d4d7a91a8607

SHA512
0bbf6557ac7978f35bc0ae8b38296cb071c86a0d195f5ac35b72e43bf4d64709aa31af82701d2cb8075553f18acb332abdfb6c3f0a12db0ddf40dfb0bbcd352f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe

Filesize
468KB

MD5
2fa6d09deb13950daf99d1b64c67b257

SHA1
07b32666bc111ea2e3e2bda216b918b6b72e3dc2

SHA256
fc6a2a279ff14a101353ad3231c9fd90d823b59e1e0a3de2c587fb62a2bc5584

SHA512
0174b44c5c1a4ded5f858d3ce95e33b04e9416bb55b92a48adb46dad9931dd06c9da22fbd91d318d27f1c5654f1ee23f66c287b3b2b6cf462fe969a8740a514e

Download Submit
memory/280-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-383-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/1392-217-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/1392-218-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/1392-384-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download
memory/1392-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-256-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1644-255-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/1644-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-237-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1704-238-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1704-424-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1704-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-425-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1708-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-400-0x0000000001ED0000-0x0000000001F45000-memory.dmp

Filesize
468KB

Download
memory/1712-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-292-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1712-290-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1876-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-213-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/1884-366-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1884-214-0x0000000003440000-0x00000000034B5000-memory.dmp

Filesize
468KB

Download
memory/1884-367-0x0000000002910000-0x0000000002985000-memory.dmp

Filesize
468KB

Download
memory/1884-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-381-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1908-380-0x00000000025A0000-0x0000000002615000-memory.dmp

Filesize
468KB

Download
memory/1920-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-192-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1940-345-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1940-346-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1940-193-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/1940-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-306-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2004-305-0x0000000002630000-0x00000000026A5000-memory.dmp

Filesize
468KB

Download
memory/2004-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2112-43-0x00000000033D0000-0x0000000003445000-memory.dmp

Filesize
468KB

Download
memory/2144-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-336-0x0000000003420000-0x0000000003495000-memory.dmp

Filesize
468KB

Download
memory/2236-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-335-0x0000000003420000-0x0000000003495000-memory.dmp

Filesize
468KB

Download
memory/2260-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2272-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-407-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-235-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-11-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-127-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-143-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-234-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2404-403-0x0000000002700000-0x0000000002775000-memory.dmp

Filesize
468KB

Download
memory/2420-252-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2420-253-0x0000000002620000-0x0000000002695000-memory.dmp

Filesize
468KB

Download
memory/2420-31-0x0000000003610000-0x0000000003685000-memory.dmp

Filesize
468KB

Download
memory/2420-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-275-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2444-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-413-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2444-410-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2460-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-161-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2724-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-162-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2724-260-0x00000000026B0000-0x0000000002725000-memory.dmp

Filesize
468KB

Download
memory/2732-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-172-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2796-166-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2796-309-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2796-313-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2800-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-128-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2872-277-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2872-144-0x0000000002930000-0x00000000029A5000-memory.dmp

Filesize
468KB

Download
memory/2872-276-0x0000000003460000-0x00000000034D5000-memory.dmp

Filesize
468KB

Download
memory/2888-95-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2888-94-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2888-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2888-297-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/2888-291-0x0000000001E20000-0x0000000001E95000-memory.dmp

Filesize
468KB

Download
memory/3032-355-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/3032-356-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/3032-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads