897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
Size

468KB
MD5

04b1ceea6a2a05fc222a6deb51108b40
SHA1

ced0b304221183709fb11bb2f9356f0af51b9d6a
SHA256

897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef
SHA512

51007e7634b92316938281c697b8cd40dae0ab0f61ba499c917a258cfeba40933c6f6b5bf7d8cd2ae1b0c99cff66648a907103ab9706581d81cde8e6b56a2777
SSDEEP

3072:WqFCo7L+jY8UDbYkPz5jof5aCYjWIpPnmHevVZsOebFojuNg3lg:WqAoi1UD3P1jofJ0pwOepeuNg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1960	Unicorn-12929.exe
2768	Unicorn-33153.exe
2624	Unicorn-57335.exe
2780	Unicorn-17943.exe
2468	Unicorn-14605.exe
2368	Unicorn-26303.exe
284	Unicorn-36509.exe
2732	Unicorn-16485.exe
2268	Unicorn-30936.exe
1016	Unicorn-11497.exe
1624	Unicorn-24496.exe
824	Unicorn-27834.exe
1144	Unicorn-44362.exe
480	Unicorn-60433.exe
2020	Unicorn-13727.exe
2256	Unicorn-32624.exe
2448	Unicorn-53791.exe
2000	Unicorn-34544.exe
2552	Unicorn-894.exe
1480	Unicorn-39889.exe
336	Unicorn-27423.exe
1280	Unicorn-14616.exe
2232	Unicorn-30688.exe
1192	Unicorn-8678.exe
956	Unicorn-39313.exe
2300	Unicorn-14808.exe
1740	Unicorn-14808.exe
1688	Unicorn-3303.exe
1924	Unicorn-52312.exe
1692	Unicorn-6640.exe
1568	Unicorn-16158.exe
2672	Unicorn-61015.exe
2476	Unicorn-23748.exe
2728	Unicorn-21711.exe
2548	Unicorn-34901.exe
2364	Unicorn-14118.exe
2516	Unicorn-46718.exe
1520	Unicorn-12774.exe
864	Unicorn-4606.exe
1952	Unicorn-1269.exe
2820	Unicorn-9245.exe
1664	Unicorn-13158.exe
1128	Unicorn-15388.exe
532	Unicorn-6251.exe
1460	Unicorn-24700.exe
2128	Unicorn-31451.exe
2252	Unicorn-20018.exe
2068	Unicorn-64580.exe
2868	Unicorn-28378.exe
572	Unicorn-48244.exe
1484	Unicorn-7403.exe
316	Unicorn-14994.exe
3048	Unicorn-40460.exe
1696	Unicorn-40460.exe
1284	Unicorn-20594.exe
1628	Unicorn-16706.exe
2216	Unicorn-16706.exe
1508	Unicorn-42380.exe
2052	Unicorn-63869.exe
564	Unicorn-27859.exe
1556	Unicorn-47725.exe
2200	Unicorn-63491.exe
2888	Unicorn-52556.exe
2720	Unicorn-52925.exe

Loads dropped DLL 64 IoCs

pid	Process
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
1960	Unicorn-12929.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
1960	Unicorn-12929.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2768	Unicorn-33153.exe
2768	Unicorn-33153.exe
1960	Unicorn-12929.exe
1960	Unicorn-12929.exe
2624	Unicorn-57335.exe
2624	Unicorn-57335.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2780	Unicorn-17943.exe
2780	Unicorn-17943.exe
2768	Unicorn-33153.exe
2768	Unicorn-33153.exe
2368	Unicorn-26303.exe
2368	Unicorn-26303.exe
284	Unicorn-36509.exe
284	Unicorn-36509.exe
2624	Unicorn-57335.exe
2624	Unicorn-57335.exe
2468	Unicorn-14605.exe
2468	Unicorn-14605.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
1960	Unicorn-12929.exe
1960	Unicorn-12929.exe
2732	Unicorn-16485.exe
2732	Unicorn-16485.exe
2780	Unicorn-17943.exe
2780	Unicorn-17943.exe
2268	Unicorn-30936.exe
2268	Unicorn-30936.exe
2768	Unicorn-33153.exe
2768	Unicorn-33153.exe
1144	Unicorn-44362.exe
1144	Unicorn-44362.exe
2468	Unicorn-14605.exe
2468	Unicorn-14605.exe
2020	Unicorn-13727.exe
2020	Unicorn-13727.exe
1960	Unicorn-12929.exe
1960	Unicorn-12929.exe
824	Unicorn-27834.exe
824	Unicorn-27834.exe
2624	Unicorn-57335.exe
2624	Unicorn-57335.exe
1016	Unicorn-11497.exe
1624	Unicorn-24496.exe
1624	Unicorn-24496.exe
1016	Unicorn-11497.exe
2368	Unicorn-26303.exe
284	Unicorn-36509.exe
480	Unicorn-60433.exe
284	Unicorn-36509.exe
2368	Unicorn-26303.exe
480	Unicorn-60433.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
2448	Unicorn-53791.exe
2448	Unicorn-53791.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
5604	3976	WerFault.exe	308
5640	4132	WerFault.exe	323
5656	4124	WerFault.exe	322
5648	4116	WerFault.exe	321
5688	3872	WerFault.exe	318
5696	4108	WerFault.exe	320
5704	4140	WerFault.exe	332

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
1960	Unicorn-12929.exe
2768	Unicorn-33153.exe
2624	Unicorn-57335.exe
2780	Unicorn-17943.exe
284	Unicorn-36509.exe
2368	Unicorn-26303.exe
2468	Unicorn-14605.exe
2732	Unicorn-16485.exe
2268	Unicorn-30936.exe
1144	Unicorn-44362.exe
480	Unicorn-60433.exe
1624	Unicorn-24496.exe
1016	Unicorn-11497.exe
824	Unicorn-27834.exe
2020	Unicorn-13727.exe
2256	Unicorn-32624.exe
2448	Unicorn-53791.exe
2000	Unicorn-34544.exe
2552	Unicorn-894.exe
1480	Unicorn-39889.exe
336	Unicorn-27423.exe
1280	Unicorn-14616.exe
956	Unicorn-39313.exe
1192	Unicorn-8678.exe
1688	Unicorn-3303.exe
1924	Unicorn-52312.exe
2300	Unicorn-14808.exe
2232	Unicorn-30688.exe
1740	Unicorn-14808.exe
1568	Unicorn-16158.exe
1692	Unicorn-6640.exe
2672	Unicorn-61015.exe
2728	Unicorn-21711.exe
2476	Unicorn-23748.exe
2548	Unicorn-34901.exe
2364	Unicorn-14118.exe
2516	Unicorn-46718.exe
864	Unicorn-4606.exe
1520	Unicorn-12774.exe
1952	Unicorn-1269.exe
2820	Unicorn-9245.exe
1664	Unicorn-13158.exe
1128	Unicorn-15388.exe
532	Unicorn-6251.exe
1460	Unicorn-24700.exe
2128	Unicorn-31451.exe
2068	Unicorn-64580.exe
2252	Unicorn-20018.exe
2868	Unicorn-28378.exe
572	Unicorn-48244.exe
1484	Unicorn-7403.exe
2216	Unicorn-16706.exe
564	Unicorn-27859.exe
1628	Unicorn-16706.exe
2052	Unicorn-63869.exe
316	Unicorn-14994.exe
3048	Unicorn-40460.exe
1696	Unicorn-40460.exe
1556	Unicorn-47725.exe
1284	Unicorn-20594.exe
2200	Unicorn-63491.exe
1508	Unicorn-42380.exe
2888	Unicorn-52556.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1960	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	28
PID 2940 wrote to memory of 1960	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	28
PID 2940 wrote to memory of 1960	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	28
PID 2940 wrote to memory of 1960	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	28
PID 1960 wrote to memory of 2768	1960	Unicorn-12929.exe	29
PID 1960 wrote to memory of 2768	1960	Unicorn-12929.exe	29
PID 1960 wrote to memory of 2768	1960	Unicorn-12929.exe	29
PID 1960 wrote to memory of 2768	1960	Unicorn-12929.exe	29
PID 2940 wrote to memory of 2624	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 2624	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 2624	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	30
PID 2940 wrote to memory of 2624	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	30
PID 2768 wrote to memory of 2780	2768	Unicorn-33153.exe	31
PID 2768 wrote to memory of 2780	2768	Unicorn-33153.exe	31
PID 2768 wrote to memory of 2780	2768	Unicorn-33153.exe	31
PID 2768 wrote to memory of 2780	2768	Unicorn-33153.exe	31
PID 1960 wrote to memory of 2468	1960	Unicorn-12929.exe	32
PID 1960 wrote to memory of 2468	1960	Unicorn-12929.exe	32
PID 1960 wrote to memory of 2468	1960	Unicorn-12929.exe	32
PID 1960 wrote to memory of 2468	1960	Unicorn-12929.exe	32
PID 2624 wrote to memory of 2368	2624	Unicorn-57335.exe	33
PID 2624 wrote to memory of 2368	2624	Unicorn-57335.exe	33
PID 2624 wrote to memory of 2368	2624	Unicorn-57335.exe	33
PID 2624 wrote to memory of 2368	2624	Unicorn-57335.exe	33
PID 2940 wrote to memory of 284	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 284	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 284	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	34
PID 2940 wrote to memory of 284	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	34
PID 2780 wrote to memory of 2732	2780	Unicorn-17943.exe	35
PID 2780 wrote to memory of 2732	2780	Unicorn-17943.exe	35
PID 2780 wrote to memory of 2732	2780	Unicorn-17943.exe	35
PID 2780 wrote to memory of 2732	2780	Unicorn-17943.exe	35
PID 2768 wrote to memory of 2268	2768	Unicorn-33153.exe	36
PID 2768 wrote to memory of 2268	2768	Unicorn-33153.exe	36
PID 2768 wrote to memory of 2268	2768	Unicorn-33153.exe	36
PID 2768 wrote to memory of 2268	2768	Unicorn-33153.exe	36
PID 2368 wrote to memory of 1016	2368	Unicorn-26303.exe	37
PID 2368 wrote to memory of 1016	2368	Unicorn-26303.exe	37
PID 2368 wrote to memory of 1016	2368	Unicorn-26303.exe	37
PID 2368 wrote to memory of 1016	2368	Unicorn-26303.exe	37
PID 284 wrote to memory of 824	284	Unicorn-36509.exe	38
PID 284 wrote to memory of 824	284	Unicorn-36509.exe	38
PID 284 wrote to memory of 824	284	Unicorn-36509.exe	38
PID 284 wrote to memory of 824	284	Unicorn-36509.exe	38
PID 2624 wrote to memory of 1624	2624	Unicorn-57335.exe	39
PID 2624 wrote to memory of 1624	2624	Unicorn-57335.exe	39
PID 2624 wrote to memory of 1624	2624	Unicorn-57335.exe	39
PID 2624 wrote to memory of 1624	2624	Unicorn-57335.exe	39
PID 2468 wrote to memory of 1144	2468	Unicorn-14605.exe	40
PID 2468 wrote to memory of 1144	2468	Unicorn-14605.exe	40
PID 2468 wrote to memory of 1144	2468	Unicorn-14605.exe	40
PID 2468 wrote to memory of 1144	2468	Unicorn-14605.exe	40
PID 2940 wrote to memory of 480	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 480	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 480	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	41
PID 2940 wrote to memory of 480	2940	897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe	41
PID 1960 wrote to memory of 2020	1960	Unicorn-12929.exe	42
PID 1960 wrote to memory of 2020	1960	Unicorn-12929.exe	42
PID 1960 wrote to memory of 2020	1960	Unicorn-12929.exe	42
PID 1960 wrote to memory of 2020	1960	Unicorn-12929.exe	42
PID 2732 wrote to memory of 2256	2732	Unicorn-16485.exe	43
PID 2732 wrote to memory of 2256	2732	Unicorn-16485.exe	43
PID 2732 wrote to memory of 2256	2732	Unicorn-16485.exe	43
PID 2732 wrote to memory of 2256	2732	Unicorn-16485.exe	43

C:\Users\Admin\AppData\Local\Temp\897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\897a2522b90485ddd17e359a2fa10cfdfe151ef6d52ba800e1548a2d2b9c21ef_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21711.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46210.exe
        8⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        9⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        9⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        9⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        9⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        9⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        8⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45807.exe
        8⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9048.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        8⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        8⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34901.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        7⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61391.exe
        8⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        7⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        6⤵
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52925.exe
        7⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33813.exe
        8⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13965.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        7⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        6⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        7⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        8⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        7⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
        7⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        6⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 188
        7⤵
        Program crash
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        6⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        6⤵
        
        PID:352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        7⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
        7⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        6⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        6⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61129.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        6⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32386.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        7⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64443.exe
        6⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        6⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1971.exe
        5⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43299.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42651.exe
        6⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59993.exe
        5⤵
        
        PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65150.exe
        5⤵
        
        PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17701.exe
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15270.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12774.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        8⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        8⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        7⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        6⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31701.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59083.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        6⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        6⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 188
        7⤵
        Program crash
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        6⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        6⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        5⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        6⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26314.exe
        5⤵
        
        PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20606.exe
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44545.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12108.exe
        5⤵
        
        PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14118.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14497.exe
        6⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29408.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        7⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29590.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27880.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32684.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4997.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
        5⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
        5⤵
        
        PID:4132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 188
        6⤵
        Program crash
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31536.exe
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        5⤵
        
        PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
        5⤵
        
        PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      4⤵
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11629.exe
        6⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29410.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50819.exe
        6⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50954.exe
        5⤵
        
        PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50973.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        5⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64097.exe
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12201.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4606.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10076.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
        7⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2964.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1705.exe
        6⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59618.exe
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        7⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        6⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        6⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        6⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1269.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56573.exe
        6⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44384.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9818.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        6⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36867.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56117.exe
        6⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40329.exe
        5⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        6⤵
        
        PID:700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10862.exe
        5⤵
        
        PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60863.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57903.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        5⤵
        
        PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        6⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26126.exe
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        6⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15855.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        6⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
        5⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40390.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        5⤵
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        5⤵
        
        PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        5⤵
        
        PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21290.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63738.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      4⤵
      PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48985.exe
      4⤵
      PID:7712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26413.exe
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27676.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51041.exe
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        6⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55748.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        5⤵
        
        PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        5⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        5⤵
        
        PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        5⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        6⤵
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65056.exe
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49225.exe
        5⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        5⤵
        
        PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        5⤵
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        5⤵
        
        PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18506.exe
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:4116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 188
        5⤵
        Program crash
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41240.exe
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
      4⤵
      PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30688.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63869.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10901.exe
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18693.exe
        6⤵
        
        PID:648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
        6⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        5⤵
        
        PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50133.exe
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34082.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
      4⤵
      PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50456.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36504.exe
        5⤵
        
        PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60717.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      4⤵
      PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe
      4⤵
      PID:8312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6686.exe
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21568.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51249.exe
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64943.exe
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
    3⤵
    PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
    3⤵
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53071.exe
    3⤵
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
    3⤵
    PID:7892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21047.exe
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7816.exe
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29511.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4713.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59179.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        6⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16907.exe
        6⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12976.exe
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12703.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56651.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46104.exe
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31805.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35707.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        5⤵
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
        5⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4987.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24573.exe
        5⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        5⤵
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52312.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        6⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
        7⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41003.exe
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55271.exe
        6⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38518.exe
        6⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54239.exe
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        6⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        5⤵
        
        PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59272.exe
        5⤵
        
        PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6687.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58360.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        5⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53336.exe
        5⤵
        
        PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17927.exe
      4⤵
      PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27066.exe
        5⤵
        
        PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50225.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28288.exe
      4⤵
      PID:7608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48244.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18354.exe
        6⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61264.exe
        7⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58094.exe
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        6⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        5⤵
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39455.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
        5⤵
        
        PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52537.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34234.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55164.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        5⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
      4⤵
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:4108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 188
        5⤵
        Program crash
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
      4⤵
      PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43579.exe
        5⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        6⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        6⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48381.exe
        5⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
        5⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
        5⤵
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11127.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        5⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5217.exe
        5⤵
        
        PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54246.exe
      4⤵
      PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 188
        5⤵
        Program crash
        
        PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34147.exe
      4⤵
      PID:8708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60538.exe
      4⤵
      PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1405.exe
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
      4⤵
      PID:8604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59456.exe
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48609.exe
    3⤵
    PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
    3⤵
    PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6411.exe
    3⤵
    PID:8640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20414.exe
        6⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17835.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31773.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        7⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13254.exe
        6⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37639.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4457.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        6⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        5⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45817.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        5⤵
        
        PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28925.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41516.exe
        5⤵
        
        PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
        5⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        5⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48110.exe
        5⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        5⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31065.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
      4⤵
      PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19119.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51104.exe
      4⤵
      PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63366.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57940.exe
        5⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22647.exe
        5⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        5⤵
        
        PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42021.exe
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26271.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
      4⤵
      PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44015.exe
      4⤵
      PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58558.exe
        5⤵
        
        PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18576.exe
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37545.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      4⤵
      PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
      4⤵
      PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
    3⤵
    PID:5580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
    3⤵
    PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
    3⤵
    PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
    3⤵
    PID:8208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12821.exe
        5⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46545.exe
        5⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24474.exe
        5⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
      4⤵
      PID:340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        5⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4954.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29913.exe
        5⤵
        
        PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
      4⤵
      PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
      4⤵
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49695.exe
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53075.exe
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37936.exe
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
      4⤵
      PID:7704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
      4⤵
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
        5⤵
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        5⤵
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29351.exe
        5⤵
        
        PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
      4⤵
      PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56644.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
      4⤵
      PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29947.exe
      4⤵
      PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7765.exe
    3⤵
    PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35913.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7257.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
      4⤵
      PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1300.exe
    3⤵
    PID:4140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 188
      4⤵
      Program crash
      PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54188.exe
    3⤵
    PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
    3⤵
    PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
    3⤵
    PID:7988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7403.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
      4⤵
      PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37405.exe
      4⤵
      PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
      4⤵
      PID:7824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23119.exe
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
    3⤵
    PID:5404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
    3⤵
    PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57897.exe
    3⤵
    PID:8856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14994.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30815.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29939.exe
    3⤵
    PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57331.exe
    3⤵
    PID:7728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15882.exe
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31363.exe
  2⤵
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
  2⤵
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
  2⤵
  PID:5344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
  2⤵
  PID:7636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6003.exe
  2⤵
  PID:8484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe

Filesize
468KB

MD5
2392f36b7bf9739b2a8e97a19019f8c6

SHA1
3b9a6f2abbaf743746600912f1bcc47a1473d9f9

SHA256
b58646e8e5be085246a9b3c4cbbcf5568836b4370bba1ad75936f7dbee617c7d

SHA512
bc39a562d50a9a7acad19624237f908d10d429a57a416e5618d4a29f4972a3d47a3e15eee431ba3f6c12fd391232039c2bc4426a45f92d7d2a427daa824982bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe

Filesize
468KB

MD5
3df3497c84e4671f401145fec8700828

SHA1
8f865fbf9a29116555c01711caa4b5c8386225fe

SHA256
81f988d7baaabba3de95e1458e63aefec942f2b0d39a915062525e2ac1347189

SHA512
20f16214b4734527c517fe683a0f3c885c4a11d078685338bda82cedac6bbf318d49c64276a3345e579a1aaf1709fd65643d8832d059713478bf86ff9609cfe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14431.exe

Filesize
468KB

MD5
56fbb118a2901aca4022d841a9c9cb9b

SHA1
e42b198217f8d8884e66ac3ffff8264df2273a57

SHA256
6bf8ed476039618d276f1d3cb4b652868b574119c46d0baa9e92ac5ff5a8593f

SHA512
95f2aa6e0f6330939763fd9079861dccc3c71bd8fe678eb79ed1a267406fafb73455a5002c029cfc18253894ba484349014321e94c581b508eaf7609780a16c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe

Filesize
468KB

MD5
0273cb33fab4035fd8ecccf38e53be7e

SHA1
e0cd4be1d6f1b9849eaa4a61e6e11856d6c3066a

SHA256
8e15f0871c78c679ab061dd3897cab30aec618c6126495a80b7762020c53c2a3

SHA512
824e6bd0a639fcadb281e256812d301483f921c4ce662140ff5eeefe3e93de93cb5bb34a29d8e7e9141817f641341bd84c4fa660ff1a500278e6721c6885ba52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe

Filesize
468KB

MD5
85cf4ff2e2abc5f448e6a6ac003e1be2

SHA1
a2e6e760d582a425f17f20da6deac69fd38e6a74

SHA256
d68a7a9d9f46f85088a63199884ae4239d5195ef5465c21dd2d78f1414937970

SHA512
3d2c939f795205aa1f7650094af6d449f527e99a6fad7c81c208947f8ccd7e339591a71123b4d57d9ff6c75f997d4f8ed8e8aa340a05640e10d2aa1fba75e4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53791.exe

Filesize
468KB

MD5
8bc39e58da9594626ce3e164aa54b0ba

SHA1
4a25643838702fc67d845c20d48bdd6be158d6f6

SHA256
981773d1c1fb26f6d285914137a2d13efb7126c56e1f5e1ea46e1195331d8c3d

SHA512
7912d17626410ef19c7ff46085089bded8f6fe668c3538bf40881591553b9be6fa75d0119d86149349f548520593ba5d5327c66a483b404782d180ddd4198dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe

Filesize
468KB

MD5
dfbc689d375a1ec10a56d80cec64b7de

SHA1
c4e19785ef3df32539e0c256d074be00d3129167

SHA256
6e2bc0fa9c46cae52d6c78913c5dc70c0690cafadaca7ce0d539710a27fed7fc

SHA512
ddae2b5a7393b0b927e8810371d46bf5e9de9770d5fc7ab0eed1c32b8c1e15bffb9656df00ace32c4442784c217ec70c36b02a14dd3df3a77db5b9bd04619e10

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe

Filesize
468KB

MD5
47bbbe0d98681010bdc87d3da6b04181

SHA1
df749d79400f8f81acbbaff2a892bad8f0cf5ea4

SHA256
d27a73ccbe7d4d7a26b2e0843c23fb69a7ccd56608282dd26f976bc3dc40173f

SHA512
134d2a3366918388350e329919bcce44d11def50372a2fb5a66dc8731eab0d85545b316afd4825c9c41c2f36c94d6132ca8146e028cf74bb00bf2611689306f5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe

Filesize
468KB

MD5
633911e490b0cf603bbec8b94434296a

SHA1
3cc29daa9ee9edfae1c77f6ed8dc5465dca5f281

SHA256
37445ca1139c88895ed7aca013917eb5b8682e3c367c9729bc2bdf59b22b10a5

SHA512
c2c9b22e350f40487cc8044242ac81f140ec2cbfe85b479187eb8160e9abc296e062efdbe1819b16244e7606b8f3659f2a02c6394da3714a01347b0455b920ab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe

Filesize
468KB

MD5
d9a140a499fd8e8d18aab5156e50315d

SHA1
de1eb341981e14ae91af4cd643903c07ff00d99d

SHA256
75b678489537e3bc291d29831794cea8ff14c6768ea2645974cdb1044f366c57

SHA512
c593e46eef10788fce32a79f60b205965ab49804acd316ee040c69c5352cd3a3f6eea28c2207e36382335d3d44d7e0bf16e6a664f0d6b049467d6536ea299777

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16485.exe

Filesize
468KB

MD5
c36f1f2292c94b5181307a5a2c7a70c4

SHA1
7494d007638b7c9f6a8b4754cc7c42693be1fab7

SHA256
e6ebbc414fb2293a36fdd9f1e0a03d958bf965d1fa6ba407544fd1808116ffd6

SHA512
c2c4f5e743badcc03666b42ad1ebca3a609869bcab514d243b004929a7ed8922fa4d3cd1add31d94b3458803dcf64777e353fc145a16945280661e047c7df14b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17943.exe

Filesize
468KB

MD5
6121f3034739f3172b284f4809eabcde

SHA1
7297e8cc1b96f3b25025d431f1dc7864aac74104

SHA256
438a72cc14520f77ac404952398dfda2a5c6ad5e0a2c54d542d699a177ca7266

SHA512
c57024e25ad98738e17277b2fd96cc16c19ef97abf8c9ce079a5bddc030f19430b0ea043576fe08e2426301f06d3c558ee54e58c1128af13e4a93a9c2e364ff8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24496.exe

Filesize
468KB

MD5
380901d55e7047c23f45c3a1508d5cce

SHA1
1aad0f55c4a8c79cd555f29fc18b696e3c36fd12

SHA256
878682455c455fa14a6cf7f1e39a906ebba3128dcaf2b63171f4bf4ffa01a594

SHA512
de9f5fa0ae0a241e14822c9af64b1eab5820aa0f849a76c909ec542d9d783ff594e9bdb5164cc0a72bcc56a39cadb3c672f5a48f9358e00b280afb554e2f6304

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26303.exe

Filesize
468KB

MD5
7ee1d099947a2e446c552b8145484b2a

SHA1
66c219768d100cf266ef340da10b88acdf1f48af

SHA256
2575c2f6383ebb4645335ccfa8070b73d34e5c68b5715163cea8417751db1e34

SHA512
85efa725f38e55a3fb8adf1b96e5187c348f5ae75a42efc91a54621daef98596982e2f5c7d31e2c45145ead3686b1e61fded81fd9810240a11d9794d1fe9feef

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe

Filesize
468KB

MD5
6b00a3af32e2c742a730f3597772f73e

SHA1
996d63c1461be09de93c70bcf11441c05ebf2d18

SHA256
f39680f57ef31b1448ab289caa243109d77e3056340a2af0d59a80029ea11498

SHA512
f0272c991006af03f9d38b1225d01921825ef866031cb7e8d083af99e17b8ed4ed4ea8211165949b7d5f5669eaf0a8e4cb210825433b6731eddbeabd1a78a347

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe

Filesize
468KB

MD5
643620ad25dd2b0d65f67ae3a39c7f74

SHA1
755e954e8fa5774e410ab6baa52d2b291fff4bd3

SHA256
86a15015160db72850f76ed66957f751fe9dcb3e46edf41b871586732b8e7a31

SHA512
1c59207b33c7a52ed6a757bfaed001584168f51bc88c29ce5bf975e07872a11c97db9c97c7907bf31bec86ed484401aacd77a4d2a40ece27fc332e23533d5caa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe

Filesize
468KB

MD5
8eee9d1f14457159208df4ed52013a6c

SHA1
d97a534bf9c801192687b5a2e62000d51c8fcd23

SHA256
19bc9747c904cbe2f3aad59ca33ba7bc8482015f564e7fa8d9f84810f74153b7

SHA512
7ee82dfc6b4e971c4f6e454e4069b21214f70bdc678e284a3f6f1f975f5e0018f488ab15c652ea54d645f8ecd0a813451bed0e632bd30d7d45c9d9241c7e2e3f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-34544.exe

Filesize
468KB

MD5
ca9e7699966193d676f35f73feedea18

SHA1
dd704fb30d1a65fb3ffcc96c5eb14435be2bb8a8

SHA256
391e70941c4d4bf11748254f2fe43448445ff8e26dcbaf3da7640d56030014ac

SHA512
42d8f08d81c2a3054fcb92eb277b5e92b918338bbfbde4c21e4650a981a45cbd753f532e0b1db2b31a7eaf7b7f8fc8fa6c4f9522f7a2e8698d1c7125df47802f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe

Filesize
468KB

MD5
8eee88d1cce2bc80c520164a7c39c04f

SHA1
a0e894e2fc7db7260660bc5d68c3a969ecbc11e8

SHA256
c44f4d3d2ae2ac9419f8300ed7894a54476ce0aba3550f4a08c30620eb810451

SHA512
1f7cbe3dbd2df09b1b3e9bb7bdc3d2c6bd00df49a5fc9fda8ee5225a0e80474932bea9c45bea61c86b621b494be8f78eb217d1f4c0cb9919f8640321bc6d62cf

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44362.exe

Filesize
468KB

MD5
01610f47c30dfd8d3238ba59a2cba97d

SHA1
f6dd307fc99d04b652a97d373161ee0a7c4e6b41

SHA256
56b2223acebaa69a05ec4342febebf0c23759a476ab182c0febffae5b2f261ca

SHA512
7efc0f5415e1b1321ac55084b3b48901639b4f4ec82d227162bcb4a8c78e0c407ddb5b8697dd2d3bd92273044f0f43c37db49be4d92ccce0288069a2824ce394

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57335.exe

Filesize
468KB

MD5
468e26e8a8aa30eac5f31b43eacc695a

SHA1
b2a9ec9367ebd1babc16bd240e4164f582337161

SHA256
94bfa56f0cd2cb6b3bd3fd50be44162049ad1c26e58b0adaa0da33ed37a3ad0a

SHA512
6d2b57f0b3e180d6493da612b2e245fd3eaf9649d170316e9661ac98b43940848aaaca0b1954de37847f8a2f9da3ce58ef6641334be54d929e98cdd042590582

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-894.exe

Filesize
468KB

MD5
59ecaa81811b980e29753f98a4aa83fb

SHA1
f64ab2b055e61cd1b99aa43ab8ae026a3858f59d

SHA256
624595f9f4765569453e32f1f6bb30455a63111b8e1c8a6931e18727aefa203d

SHA512
4bafbb18ade1edc5aa432d35938677146f92e0b4ea33b1b8fffc91ff3b5a1a98c4a06c5dba8b0a596f1beeaa25460c0c8adc1a9b2ba711713874fe0212143cd1

Download Submit
memory/284-314-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/284-128-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/284-306-0x0000000002430000-0x00000000024A5000-memory.dmp

Filesize
468KB

Download
memory/336-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/480-324-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/480-307-0x0000000002490000-0x0000000002505000-memory.dmp

Filesize
468KB

Download
memory/480-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-283-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/824-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-284-0x00000000024C0000-0x0000000002535000-memory.dmp

Filesize
468KB

Download
memory/956-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-295-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1016-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-297-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1144-242-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/1144-243-0x0000000002420000-0x0000000002495000-memory.dmp

Filesize
468KB

Download
memory/1144-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-419-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1480-412-0x0000000002870000-0x00000000028E5000-memory.dmp

Filesize
468KB

Download
memory/1520-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-298-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1624-296-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1624-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-268-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/1960-32-0x0000000003410000-0x0000000003485000-memory.dmp

Filesize
468KB

Download
memory/1960-174-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/1960-175-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/1960-281-0x0000000002720000-0x0000000002795000-memory.dmp

Filesize
468KB

Download
memory/2000-401-0x00000000022C0000-0x0000000002335000-memory.dmp

Filesize
468KB

Download
memory/2000-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-409-0x00000000022C0000-0x0000000002335000-memory.dmp

Filesize
468KB

Download
memory/2020-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-265-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2020-263-0x0000000002480000-0x00000000024F5000-memory.dmp

Filesize
468KB

Download
memory/2232-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-367-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2256-371-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2268-223-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2268-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-222-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2364-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-316-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2368-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2368-303-0x0000000000560000-0x00000000005D5000-memory.dmp

Filesize
468KB

Download
memory/2448-352-0x00000000033E0000-0x0000000003455000-memory.dmp

Filesize
468KB

Download
memory/2448-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-353-0x00000000025F0000-0x0000000002665000-memory.dmp

Filesize
468KB

Download
memory/2468-254-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-253-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-154-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2468-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-389-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2552-394-0x00000000028E0000-0x0000000002955000-memory.dmp

Filesize
468KB

Download
memory/2624-289-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2624-290-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2624-145-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2624-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-72-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2624-144-0x0000000000580000-0x00000000005F5000-memory.dmp

Filesize
468KB

Download
memory/2672-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-197-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-382-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-383-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2732-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-191-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2768-237-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2768-44-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2768-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-228-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2768-399-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2768-408-0x0000000000380000-0x00000000003F5000-memory.dmp

Filesize
468KB

Download
memory/2780-94-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-205-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-206-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-365-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-364-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2780-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-331-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2940-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-327-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2940-33-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2940-156-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2940-158-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download
memory/2940-6-0x00000000024D0000-0x0000000002545000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads