659ed351ec85ba910e9bfb97b8534b1ca678c7ed73aaff236e21cb27ca636b86

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
Size

468KB
MD5

68a21d61af4d69d921c3c4407aa70f60
SHA1

638c633cbf0fc1ac0a07d07f2bdf1a1a42000668
SHA256

659ed351ec85ba910e9bfb97b8534b1ca678c7ed73aaff236e21cb27ca636b86
SHA512

795d79433854c6763ea3220fa59e4e8bda938f73cf1b24d256fa8fedfca6db5dbaa439843952fbb26c2e3c7abe0e186bf1bcc8a3f0e643823a206e49fa59ca71
SSDEEP

3072:dqmnogKxj28U2bYnPz3yqf8/EChjyIplPmHxxVH4wJS+1MKNt0lS:dqWotXU2UPDyqfX0ckwJ1uKNt

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2408	Unicorn-7743.exe
2068	Unicorn-36929.exe
2744	Unicorn-33399.exe
2640	Unicorn-18258.exe
2592	Unicorn-57873.exe
2896	Unicorn-3959.exe
2556	Unicorn-12201.exe
520	Unicorn-35344.exe
2808	Unicorn-14793.exe
936	Unicorn-25147.exe
1628	Unicorn-17171.exe
1424	Unicorn-11040.exe
2700	Unicorn-41602.exe
1620	Unicorn-30169.exe
560	Unicorn-50035.exe
1932	Unicorn-64721.exe
2108	Unicorn-25041.exe
2576	Unicorn-15905.exe
2016	Unicorn-23663.exe
2284	Unicorn-3797.exe
964	Unicorn-63470.exe
1452	Unicorn-1270.exe
944	Unicorn-46942.exe
1100	Unicorn-9630.exe
2052	Unicorn-64893.exe
2104	Unicorn-65390.exe
1752	Unicorn-24623.exe
1720	Unicorn-16839.exe
1912	Unicorn-13309.exe
1580	Unicorn-33175.exe
2352	Unicorn-19727.exe
2628	Unicorn-5100.exe
2256	Unicorn-29989.exe
2928	Unicorn-10123.exe
2644	Unicorn-13579.exe
2696	Unicorn-4259.exe
2524	Unicorn-24125.exe
2084	Unicorn-39776.exe
680	Unicorn-55152.exe
920	Unicorn-1933.exe
848	Unicorn-24016.exe
2160	Unicorn-11249.exe
1444	Unicorn-24016.exe
1008	Unicorn-37097.exe
1112	Unicorn-64753.exe
1044	Unicorn-32843.exe
2056	Unicorn-17108.exe
1952	Unicorn-30918.exe
2432	Unicorn-46761.exe
1440	Unicorn-35063.exe
2372	Unicorn-39745.exe
1296	Unicorn-33614.exe
1572	Unicorn-11711.exe
1600	Unicorn-41975.exe
880	Unicorn-56657.exe
2236	Unicorn-1898.exe
1556	Unicorn-5427.exe
3044	Unicorn-24185.exe
1712	Unicorn-56548.exe
2968	Unicorn-15708.exe
2760	Unicorn-41389.exe
2072	Unicorn-61255.exe
2472	Unicorn-20415.exe
2340	Unicorn-49750.exe

Loads dropped DLL 64 IoCs

pid	Process
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
2408	Unicorn-7743.exe
2408	Unicorn-7743.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
2744	Unicorn-33399.exe
2744	Unicorn-33399.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
2408	Unicorn-7743.exe
2408	Unicorn-7743.exe
2068	Unicorn-36929.exe
2068	Unicorn-36929.exe
2640	Unicorn-18258.exe
2640	Unicorn-18258.exe
2744	Unicorn-33399.exe
2744	Unicorn-33399.exe
2592	Unicorn-57873.exe
2592	Unicorn-57873.exe
2556	Unicorn-12201.exe
2408	Unicorn-7743.exe
2556	Unicorn-12201.exe
2408	Unicorn-7743.exe
2896	Unicorn-3959.exe
2068	Unicorn-36929.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
2896	Unicorn-3959.exe
2068	Unicorn-36929.exe
2808	Unicorn-14793.exe
2808	Unicorn-14793.exe
2744	Unicorn-33399.exe
2744	Unicorn-33399.exe
1628	Unicorn-17171.exe
1628	Unicorn-17171.exe
936	Unicorn-25147.exe
2556	Unicorn-12201.exe
2556	Unicorn-12201.exe
936	Unicorn-25147.exe
520	Unicorn-35344.exe
520	Unicorn-35344.exe
2640	Unicorn-18258.exe
2640	Unicorn-18258.exe
2592	Unicorn-57873.exe
2592	Unicorn-57873.exe
2700	Unicorn-41602.exe
2700	Unicorn-41602.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
1424	Unicorn-11040.exe
2408	Unicorn-7743.exe
1424	Unicorn-11040.exe
2408	Unicorn-7743.exe
560	Unicorn-50035.exe
560	Unicorn-50035.exe
2896	Unicorn-3959.exe
1620	Unicorn-30169.exe
2896	Unicorn-3959.exe
1620	Unicorn-30169.exe
2068	Unicorn-36929.exe
2068	Unicorn-36929.exe
1932	Unicorn-64721.exe
1932	Unicorn-64721.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2280	964	WerFault.exe	49
924	1036	WerFault.exe	132
5720	5424	WerFault.exe	509
5744	5416	WerFault.exe	508
5724	5396	WerFault.exe	505
2972	5504	WerFault.exe	506

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
2408	Unicorn-7743.exe
2744	Unicorn-33399.exe
2068	Unicorn-36929.exe
2640	Unicorn-18258.exe
2896	Unicorn-3959.exe
2592	Unicorn-57873.exe
2556	Unicorn-12201.exe
520	Unicorn-35344.exe
2808	Unicorn-14793.exe
936	Unicorn-25147.exe
1628	Unicorn-17171.exe
1424	Unicorn-11040.exe
1620	Unicorn-30169.exe
2700	Unicorn-41602.exe
560	Unicorn-50035.exe
1932	Unicorn-64721.exe
2108	Unicorn-25041.exe
2576	Unicorn-15905.exe
2016	Unicorn-23663.exe
2284	Unicorn-3797.exe
1452	Unicorn-1270.exe
2052	Unicorn-64893.exe
1100	Unicorn-9630.exe
944	Unicorn-46942.exe
964	Unicorn-63470.exe
2104	Unicorn-65390.exe
1720	Unicorn-16839.exe
1580	Unicorn-33175.exe
2352	Unicorn-19727.exe
1752	Unicorn-24623.exe
2628	Unicorn-5100.exe
2524	Unicorn-24125.exe
2084	Unicorn-39776.exe
680	Unicorn-55152.exe
2696	Unicorn-4259.exe
2928	Unicorn-10123.exe
2256	Unicorn-29989.exe
2644	Unicorn-13579.exe
920	Unicorn-1933.exe
1444	Unicorn-24016.exe
2160	Unicorn-11249.exe
848	Unicorn-24016.exe
1008	Unicorn-37097.exe
1112	Unicorn-64753.exe
1044	Unicorn-32843.exe
2056	Unicorn-17108.exe
1952	Unicorn-30918.exe
1572	Unicorn-11711.exe
2372	Unicorn-39745.exe
1296	Unicorn-33614.exe
2432	Unicorn-46761.exe
1440	Unicorn-35063.exe
1600	Unicorn-41975.exe
880	Unicorn-56657.exe
1556	Unicorn-5427.exe
1712	Unicorn-56548.exe
2236	Unicorn-1898.exe
2968	Unicorn-15708.exe
3044	Unicorn-24185.exe
2760	Unicorn-41389.exe
2340	Unicorn-49750.exe
2472	Unicorn-20415.exe
2820	Unicorn-59418.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2408	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	28
PID 1672 wrote to memory of 2408	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	28
PID 1672 wrote to memory of 2408	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	28
PID 1672 wrote to memory of 2408	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	28
PID 2408 wrote to memory of 2068	2408	Unicorn-7743.exe	29
PID 2408 wrote to memory of 2068	2408	Unicorn-7743.exe	29
PID 2408 wrote to memory of 2068	2408	Unicorn-7743.exe	29
PID 2408 wrote to memory of 2068	2408	Unicorn-7743.exe	29
PID 1672 wrote to memory of 2744	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	30
PID 1672 wrote to memory of 2744	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	30
PID 1672 wrote to memory of 2744	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	30
PID 1672 wrote to memory of 2744	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	30
PID 2744 wrote to memory of 2640	2744	Unicorn-33399.exe	31
PID 2744 wrote to memory of 2640	2744	Unicorn-33399.exe	31
PID 2744 wrote to memory of 2640	2744	Unicorn-33399.exe	31
PID 2744 wrote to memory of 2640	2744	Unicorn-33399.exe	31
PID 1672 wrote to memory of 2896	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	32
PID 1672 wrote to memory of 2896	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	32
PID 1672 wrote to memory of 2896	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	32
PID 1672 wrote to memory of 2896	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	32
PID 2408 wrote to memory of 2592	2408	Unicorn-7743.exe	33
PID 2408 wrote to memory of 2592	2408	Unicorn-7743.exe	33
PID 2408 wrote to memory of 2592	2408	Unicorn-7743.exe	33
PID 2408 wrote to memory of 2592	2408	Unicorn-7743.exe	33
PID 2068 wrote to memory of 2556	2068	Unicorn-36929.exe	34
PID 2068 wrote to memory of 2556	2068	Unicorn-36929.exe	34
PID 2068 wrote to memory of 2556	2068	Unicorn-36929.exe	34
PID 2068 wrote to memory of 2556	2068	Unicorn-36929.exe	34
PID 2640 wrote to memory of 520	2640	Unicorn-18258.exe	35
PID 2640 wrote to memory of 520	2640	Unicorn-18258.exe	35
PID 2640 wrote to memory of 520	2640	Unicorn-18258.exe	35
PID 2640 wrote to memory of 520	2640	Unicorn-18258.exe	35
PID 2744 wrote to memory of 2808	2744	Unicorn-33399.exe	36
PID 2744 wrote to memory of 2808	2744	Unicorn-33399.exe	36
PID 2744 wrote to memory of 2808	2744	Unicorn-33399.exe	36
PID 2744 wrote to memory of 2808	2744	Unicorn-33399.exe	36
PID 2592 wrote to memory of 936	2592	Unicorn-57873.exe	37
PID 2592 wrote to memory of 936	2592	Unicorn-57873.exe	37
PID 2592 wrote to memory of 936	2592	Unicorn-57873.exe	37
PID 2592 wrote to memory of 936	2592	Unicorn-57873.exe	37
PID 2556 wrote to memory of 1628	2556	Unicorn-12201.exe	38
PID 2556 wrote to memory of 1628	2556	Unicorn-12201.exe	38
PID 2556 wrote to memory of 1628	2556	Unicorn-12201.exe	38
PID 2556 wrote to memory of 1628	2556	Unicorn-12201.exe	38
PID 2408 wrote to memory of 1424	2408	Unicorn-7743.exe	39
PID 2408 wrote to memory of 1424	2408	Unicorn-7743.exe	39
PID 2408 wrote to memory of 1424	2408	Unicorn-7743.exe	39
PID 2408 wrote to memory of 1424	2408	Unicorn-7743.exe	39
PID 1672 wrote to memory of 2700	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	42
PID 1672 wrote to memory of 2700	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	42
PID 1672 wrote to memory of 2700	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	42
PID 1672 wrote to memory of 2700	1672	68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe	42
PID 2896 wrote to memory of 560	2896	Unicorn-3959.exe	40
PID 2896 wrote to memory of 560	2896	Unicorn-3959.exe	40
PID 2896 wrote to memory of 560	2896	Unicorn-3959.exe	40
PID 2896 wrote to memory of 560	2896	Unicorn-3959.exe	40
PID 2068 wrote to memory of 1620	2068	Unicorn-36929.exe	41
PID 2068 wrote to memory of 1620	2068	Unicorn-36929.exe	41
PID 2068 wrote to memory of 1620	2068	Unicorn-36929.exe	41
PID 2068 wrote to memory of 1620	2068	Unicorn-36929.exe	41
PID 2808 wrote to memory of 1932	2808	Unicorn-14793.exe	43
PID 2808 wrote to memory of 1932	2808	Unicorn-14793.exe	43
PID 2808 wrote to memory of 1932	2808	Unicorn-14793.exe	43
PID 2808 wrote to memory of 1932	2808	Unicorn-14793.exe	43

C:\Users\Admin\AppData\Local\Temp\68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\68a21d61af4d69d921c3c4407aa70f60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24125.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        9⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        9⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
        9⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        8⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        8⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        8⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
        7⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        7⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 188
        8⤵
        Program crash
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4259.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46761.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        7⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        7⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33614.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        7⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
        6⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34101.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1668.exe
        6⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53511.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        6⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30918.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        8⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33562.exe
        8⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33795.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11831.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34746.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        7⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 188
        8⤵
        Program crash
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35063.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36825.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53163.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4631.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14563.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        6⤵
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62098.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39661.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15887.exe
        6⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20424.exe
        5⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21272.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56382.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42762.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        5⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34598.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33175.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        6⤵
        Executes dropped EXE
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53271.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12367.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        6⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        6⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
        5⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        5⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31908.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        5⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45194.exe
        5⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53756.exe
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63781.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40375.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13137.exe
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34679.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23663.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55152.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56657.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        9⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        9⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        9⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        9⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50666.exe
        9⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        9⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        8⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        8⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        7⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        7⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        7⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        7⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 188
        8⤵
        Program crash
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1898.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8611.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        7⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56210.exe
        6⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        6⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 188
        7⤵
        Program crash
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7436.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        5⤵
        
        PID:1036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 188
        6⤵
        Program crash
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        5⤵
        
        PID:528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        5⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49901.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
        5⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
        5⤵
        
        PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40908.exe
        5⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56920.exe
        5⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2472.exe
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9565.exe
        5⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31412.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
      4⤵
      PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      4⤵
      PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33439.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        7⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        6⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12985.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11771.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37681.exe
        6⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-347.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34906.exe
        5⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64834.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3096.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18203.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
      4⤵
      PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65390.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7174.exe
        5⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        5⤵
        
        PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
      4⤵
      PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
      4⤵
      PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35302.exe
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39939.exe
      4⤵
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64996.exe
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
    3⤵
    PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55088.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
    3⤵
    PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
    3⤵
    PID:5708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39745.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        6⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        6⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        6⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
        6⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16013.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        6⤵
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26869.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29519.exe
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        5⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:964
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 240
        5⤵
        Program crash
        
        PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11945.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        6⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        5⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        5⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46800.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
      4⤵
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24925.exe
        5⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        5⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        5⤵
        
        PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      4⤵
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27962.exe
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31526.exe
      4⤵
      PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61057.exe
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35963.exe
      4⤵
      PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        7⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        7⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
        6⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39144.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53030.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        6⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25772.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10770.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
        5⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58339.exe
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48363.exe
        6⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48497.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        5⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1902.exe
        5⤵
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4055.exe
        5⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1797.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        5⤵
        
        PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24185.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34551.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11304.exe
        5⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12720.exe
        5⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6313.exe
        5⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17404.exe
        5⤵
        
        PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29546.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44883.exe
        5⤵
        
        PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24660.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22628.exe
      4⤵
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16417.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51835.exe
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7464.exe
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6330.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        5⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        5⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
      4⤵
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
        5⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44087.exe
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41305.exe
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48478.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28562.exe
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
    3⤵
    PID:1776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18733.exe
    3⤵
    PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31134.exe
    3⤵
    PID:3536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
    3⤵
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
    3⤵
    PID:6084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6740.exe
        5⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41199.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11775.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65246.exe
        6⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
        5⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54898.exe
      4⤵
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
      4⤵
      PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57111.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
      4⤵
      PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
    3⤵
    - Executes dropped EXE
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
      4⤵
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
      4⤵
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-900.exe
      4⤵
      PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64083.exe
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      4⤵
      PID:5444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
    3⤵
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58852.exe
    3⤵
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
    3⤵
    PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9505.exe
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35580.exe
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57609.exe
    3⤵
    PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
        5⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29135.exe
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43162.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
      4⤵
      PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5118.exe
      4⤵
      PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39164.exe
      4⤵
      PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      4⤵
      PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        
        PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        5⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27074.exe
        5⤵
        
        PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52846.exe
      4⤵
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38222.exe
      4⤵
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57977.exe
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      4⤵
      PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
    3⤵
    PID:1648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
    3⤵
    PID:1904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45803.exe
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2680.exe
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
    3⤵
    PID:5904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4216.exe
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61652.exe
    3⤵
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60800.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40045.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
    3⤵
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe
  2⤵
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15681.exe
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
  2⤵
  PID:3668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25799.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25799.exe
  2⤵
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
  2⤵
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
  2⤵
  PID:5420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe

Filesize
468KB

MD5
a3938b75dd2a08a7fcc16c6976b65a8b

SHA1
5ad2411e826e6beced12a1f97878736811fdd5ec

SHA256
aa6162928407ddc68947634a6a0441cf097651430d33cc6bcbfb0a6b9323550f

SHA512
a6f8409ac9438dc37113336688f0e6aa354f300fa49036bd781b86a39dfe42bf5a0edf8b23417d61eb29883ecf41267f05ae7c7bf74595292d688212f939b187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe

Filesize
468KB

MD5
4e7940b09399f36a4a16dcdae5f4638e

SHA1
58dbe1f64fe3e829570dda480638c11bf6b0d07e

SHA256
9ba376205cbbb1762d401615c67796ce3e91fb0c1759e31a7d5f99de443aca75

SHA512
b25e3d796b1fe4d54312c6957743aac7ab857126062de6ed2d6c1d6aeb79bdbd28a0dc0acdabdfcb02e503a4ad4b0ca14577a8c28f7e27b74379e2b4ed42caf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49297.exe

Filesize
468KB

MD5
26f1c11d4d3ac668ade0de301bbc89dc

SHA1
f9fb87da6ead4998daaa6d54c968488381896b7a

SHA256
5bc4569c2042cca03265bf4a9929ba57793daed5e4a2cb9f5e3832573e48eaae

SHA512
f74039a35daba786a1630257c6d2079910274c6232d507943911639dba0be65f1be60ac2682d5a8c977f42f742e02bfb18fb348224ca9f6d75200f5b87bc0758

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11040.exe

Filesize
468KB

MD5
5239b5f1110e71e0e10dffe553bd1b01

SHA1
09643603dda619da8396861fff4b618062bc1fcd

SHA256
346702f2d93984c2a1463f00e677bfb2a3bfa2838c99f08cb72a7a6af8dce26a

SHA512
e23626e3daa4cf0e725edc921965074d6d69531ac1647a64319a57702b597e390ea200f45633a4f837e21c57fa364829cc270cec031d1c6c1d090960ca2d9fd1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe

Filesize
468KB

MD5
713cef35fd5fd210bd139b8d73a620d0

SHA1
78cdee47227ad2f3a09785925611d75d492eb357

SHA256
6fb87c7770df2a6e44196d4b611059978049fcacb80431873c152f8a2fd59149

SHA512
7e6fa3ba7e99ea2e7b4b49e6a05d46102561b46d26ca08530ad6fb3af2706d2894438266f2506e4b10406aa8f61192b09093f747e8201e237de6201c56c39153

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe

Filesize
468KB

MD5
9c975bf8f5341930f36a8d23cfbe6a01

SHA1
c57cae2aca69226ff6f038b89fc6b52e46bb9c47

SHA256
ad2f55d091ec684c1de337b873291c3047677f2029ec107c61266788db0aaf63

SHA512
643890c9ff79e81c03810c386cd44060da64c4dfe1b8fe6e5638c690b3c85d9f8d6b5cc1987af76926b9579083f4b77753fe91f5c764fbd57f817c4340d78fcc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15905.exe

Filesize
468KB

MD5
e3ba8a06be0f366869f0311045382e2e

SHA1
e43775d00575ce1979d873c76bf1107d21ed0149

SHA256
f9c7b2c23228533037c1791666cb6498a6c608b53c7a26127d087381b5921290

SHA512
f4898e198dee46af4dc8560c8c908d6f57ff6adf71510205a212e574f6c98d906f42b54e6ce66bbef42ddff4f7f23a70ac4f9b25c000f281e56b3546d27d684d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe

Filesize
468KB

MD5
1e8afd6775b99ee6e65155cf18b443ac

SHA1
9497f48e365e1490d8a714bb66e043fac1caaec4

SHA256
28b59bb66a9885e6f00412b1c08dd4507499b4cc7cc4b0eb4ecc5ded68054480

SHA512
1f8da931c761d89ef709748e13b07bddc2b12611c9da8d5a7163369321c48243e78dcf4dd4ffd7e711b2bacdfc31bc4575aee3b31929e41dc87c497c2eebddda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25041.exe

Filesize
468KB

MD5
eb2d49332a4003a75b0a8309fc02e07e

SHA1
3d9da32a0591470fa777a80b3e6611830e983f95

SHA256
4311f9377c284ed6b65145f9adac736a0a8c3bbbd82091c918f5b6b7dbd30d10

SHA512
ab694213de70e6b1d1189412e99850187ce44afb084c396052b38da8811d6ee9b9661c9f410bbe41862f70407f22dcb71ca9d5d5eb6a3ce325351b5c6aa54baa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe

Filesize
468KB

MD5
428fe58f641d131039bfdd79ed357250

SHA1
8d882563f2510cbc7bb3300aff3ec9502f9f6c36

SHA256
f4779e0113ccbb61e663d23ba06c96946618c27991bbf9721a47d0e962fc337c

SHA512
eef1e4323d3c58368aabf9fed9fdc52e97e09d744f0eda18736163154db74656b5ebf3cf940c583a9825c0536c0b2b7324bfd402b6158aca67c966a14b359aba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe

Filesize
468KB

MD5
38ceb7e53295ba404d3c8e5a206fbd85

SHA1
280443a453e9f17bf126d55dd44a93d3c41419a4

SHA256
b968ebd06614b06297278f30a4804dfd78a02afdcb12998241910f548e93713a

SHA512
674084e1462facc8cd0dc8a5450ac3438a7930b8cb4f9081a203221d65ed8ee1d02319260aa2e70e199907751a863bc5987fb16d20676eb11a0f709b4ccc2907

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe

Filesize
468KB

MD5
535996429faa3fbeeec3682c2a8e5e3c

SHA1
6897afb5526b71e40e933d4c9849ba15bc358918

SHA256
ee877cfd83fdd15ce6ba81bdc7e5afdaba30cd45441d569026f0188ccfb1e7ae

SHA512
c6a39fdb731bf0148fc64eb623d52f4405ecb4fb33b92376e7fec3f6aa2a6b9e2bb4c3ac1043b0f3c45a139c5be1cf78e3e1aaa4c4b2528f3c081cdb43f77225

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-35344.exe

Filesize
468KB

MD5
78d929286ee8cc5317f92d7e4faa3a33

SHA1
cda25d24a7729f118846cc6aa8f6e531eec5f4ad

SHA256
ba219a1de6cad1c8daa19ed29a678cdbd6da845ff980bb95e6dee19c3b9acc6d

SHA512
e87fbe297fc629a53f75e79a6168adaf218bc27dd420e645db28331b40913ae86a97dbbef8d3a9465275ccbdac53d51a684a5f37693f19d8edc7749ecd6b82f6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36929.exe

Filesize
468KB

MD5
695b8efe11d39b11d3759fadf730409c

SHA1
7270e95f8bbb5c7d12741a3677c4a3ddae48aab1

SHA256
ebb147a9e8193eeb8786c5772b84b29d8c91b5e2806895de6dfb626854dfd192

SHA512
32f8a23d3e5e16dcecc1b33aa23ec2fcc4332cc22f4187faf386370e527599e32b6d3ca4865093a9949e1fdfd6b0a5580080b47cbe1d84076d7f606de162a386

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3959.exe

Filesize
468KB

MD5
5e3bf376a90b3e28a64e2e664989d5c9

SHA1
81da645d2460d622f17668bc21edc53c78463cfa

SHA256
6e3fb8ce82522c78dae4587a23e73ceba83e0749316fa82a765a57da5aa1fe54

SHA512
592f9ac4df50a178d743847bb266c0d0809694fd059e3c6bd7242fa555b5221b77cf3f382e53b0ec17b304607e309ebd51b75658f095628d33124f7e64c19aca

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe

Filesize
468KB

MD5
c82c3dc233a047a7337fae317336a9e7

SHA1
97ea4b890149a0087d2e860028ecc7e9276a60b4

SHA256
aa8061e1507d44a3f8a2a8efbb81a17d3776a3708eaa4800476e4bac149a53c5

SHA512
25136a0af9752eeafa779974e2a22dcdc88ef0ae7c1ec5df200aec9e90d47b99e1a366a24b4b492da9ea114ba39e0ddaa6a92ec04a606cd6bab9f29d65beaead

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe

Filesize
468KB

MD5
e504214b9351adc140a0a484d567c988

SHA1
420d10a298cc39e3ee7bc8ad7058e3001cd31f11

SHA256
68af19e9316dcf63b118cda54bd2cf4037c7324fe6a99d08b703ab67ae1c44ff

SHA512
c3220fa893f087d3e23ccef1542f8689ec9a62167d906e0fd6283f9f5c3bc85c5d7220f524744c2d26294456829c00480915e86868e50a994599cceac6324d67

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe

Filesize
468KB

MD5
78cdb881dd7376b8a0096fa7ba68c957

SHA1
9ffd4d9414d072baff09cb89db860d5c005c939d

SHA256
5df4c28ff872dd211954bb40d82969b783eb98add80c22f8f9d9c5ddf58b5c0e

SHA512
ad31ff3745a648e52c83af3d8d9faefcf6ce8cc9ccc5d14f1b7b0237b1e771ac6b537d1358fe3e1023b2f8c34c4e1737da040b5c8c44948d08f49af8e9fe12c2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe

Filesize
468KB

MD5
737ff47d3a0987e352a5d60609b3560d

SHA1
b1e5f4a1c1304a0741cbb22b340d6aedb463f533

SHA256
a1870a7c38aa9c8e393e9b36770896fa055dd4ac71d7a5ec2b00ebfaa48cde01

SHA512
8087fa442fe0dad4b4d74da13348eef9055aa88488e8067432b483707d6d69d4243073c6fee6950799f8f92ec9f9fdb61b692f261e07755b95e55b8d7b7220c9

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-7743.exe

Filesize
468KB

MD5
07fca1b7fd770bd7ccc2cbb8401afbbe

SHA1
53eaa7765e09d2dd7685af7f2be1f5af60165918

SHA256
c94bda90ffddd7c398a18d097f7bba8b6d8dd64e49992d6ce521d6c615339174

SHA512
d7a406d340a7c38e3e07b9c17ec7674941ad5b4cfbcb379f52fde71c0dc0381d5397be239126c9c7418e93ddb3d2b3cfe9687969be06408526bac0cfe7bcccfd

Download Submit
memory/520-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/520-272-0x00000000023B0000-0x0000000002425000-memory.dmp

Filesize
468KB

Download
memory/520-276-0x00000000023B0000-0x0000000002425000-memory.dmp

Filesize
468KB

Download
memory/560-321-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/560-317-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/560-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-235-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/936-244-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/936-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-303-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1424-295-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1424-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-335-0x00000000006C0000-0x0000000000735000-memory.dmp

Filesize
468KB

Download
memory/1620-329-0x00000000006C0000-0x0000000000735000-memory.dmp

Filesize
468KB

Download
memory/1620-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-227-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1628-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-221-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1628-405-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1628-396-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/1672-179-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1672-289-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/1672-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-163-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1672-291-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/1672-55-0x0000000002820000-0x0000000002895000-memory.dmp

Filesize
468KB

Download
memory/1672-6-0x0000000003350000-0x00000000033C5000-memory.dmp

Filesize
468KB

Download
memory/1720-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-364-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/1932-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-359-0x0000000002460000-0x00000000024D5000-memory.dmp

Filesize
468KB

Download
memory/2016-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-160-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2068-340-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2068-344-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2068-182-0x0000000002940000-0x00000000029B5000-memory.dmp

Filesize
468KB

Download
memory/2104-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-378-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2108-379-0x0000000002560000-0x00000000025D5000-memory.dmp

Filesize
468KB

Download
memory/2108-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-304-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2408-23-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2408-296-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2408-24-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2408-152-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2408-147-0x0000000000370000-0x00000000003E5000-memory.dmp

Filesize
468KB

Download
memory/2524-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-151-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2556-245-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2556-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-243-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2556-145-0x0000000002660000-0x00000000026D5000-memory.dmp

Filesize
468KB

Download
memory/2576-406-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2576-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-404-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2592-278-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2592-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-123-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2592-279-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2628-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-94-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2640-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-277-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2640-273-0x00000000024E0000-0x0000000002555000-memory.dmp

Filesize
468KB

Download
memory/2644-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2696-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-275-0x0000000002550000-0x00000000025C5000-memory.dmp

Filesize
468KB

Download
memory/2700-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-48-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2744-212-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2744-107-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2744-391-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2744-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-386-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2808-199-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2808-383-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2808-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-200-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2808-382-0x00000000024F0000-0x0000000002565000-memory.dmp

Filesize
468KB

Download
memory/2896-324-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2896-330-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2896-159-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2896-180-0x0000000002510000-0x0000000002585000-memory.dmp

Filesize
468KB

Download
memory/2928-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads