b87b77ec4be8a99c44f977fd211a54949ba99cab2b342610129af8d9291e18f6

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ace76588c8ad5e6667a70d40751c420N.exe
Size

468KB
MD5

7ace76588c8ad5e6667a70d40751c420
SHA1

7b2663fffd8f1c1664159fe20fbdb655394617bb
SHA256

b87b77ec4be8a99c44f977fd211a54949ba99cab2b342610129af8d9291e18f6
SHA512

3d9046a5b796d7277f18a1311e5ddaa6c364e60079696814f8592ff968ebcc32f4668e837d7c9f75dc80785e246183cf17062f14992a4b4e7a2696eafacbcd87
SSDEEP

3072:WqyCogudjYZU2bYkPW5jff5LChdWI5BnmHevVp6Hrh3fyMNgIl0:WqPolQU23PSjff3E3iHrZaMNg

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2496	Unicorn-33129.exe
1796	Unicorn-31986.exe
2700	Unicorn-43684.exe
2596	Unicorn-50202.exe
2936	Unicorn-1577.exe
2728	Unicorn-25104.exe
2588	Unicorn-11369.exe
2392	Unicorn-15360.exe
608	Unicorn-44312.exe
2680	Unicorn-48417.exe
2324	Unicorn-56320.exe
1924	Unicorn-56585.exe
2488	Unicorn-24982.exe
2880	Unicorn-9614.exe
2876	Unicorn-37020.exe
2568	Unicorn-32089.exe
2952	Unicorn-20967.exe
300	Unicorn-32473.exe
1176	Unicorn-54792.exe
1524	Unicorn-3775.exe
688	Unicorn-36640.exe
812	Unicorn-30509.exe
1268	Unicorn-44808.exe
2296	Unicorn-61263.exe
2132	Unicorn-61528.exe
2444	Unicorn-41662.exe
2164	Unicorn-61528.exe
880	Unicorn-43278.exe
316	Unicorn-32342.exe
1556	Unicorn-52208.exe
1708	Unicorn-46078.exe
2644	Unicorn-28602.exe
2504	Unicorn-63504.exe
2668	Unicorn-4097.exe
2248	Unicorn-17288.exe
2664	Unicorn-37154.exe
1276	Unicorn-22738.exe
1888	Unicorn-271.exe
1036	Unicorn-64154.exe
2520	Unicorn-38690.exe
1736	Unicorn-3531.exe
3028	Unicorn-44372.exe
2236	Unicorn-64237.exe
644	Unicorn-39468.exe
580	Unicorn-47901.exe
2176	Unicorn-12275.exe
2960	Unicorn-40309.exe
1684	Unicorn-52924.exe
1380	Unicorn-40117.exe
924	Unicorn-62700.exe
1652	Unicorn-39157.exe
3052	Unicorn-10931.exe
344	Unicorn-38965.exe
2012	Unicorn-55301.exe
284	Unicorn-47133.exe
2800	Unicorn-50267.exe
2812	Unicorn-30666.exe
2848	Unicorn-50532.exe
2828	Unicorn-2466.exe
3016	Unicorn-2873.exe
2612	Unicorn-11803.exe
1628	Unicorn-29985.exe
2000	Unicorn-44092.exe
2660	Unicorn-13265.exe

Loads dropped DLL 64 IoCs

pid	Process
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2496	Unicorn-33129.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2496	Unicorn-33129.exe
1796	Unicorn-31986.exe
2700	Unicorn-43684.exe
1796	Unicorn-31986.exe
2700	Unicorn-43684.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2496	Unicorn-33129.exe
2496	Unicorn-33129.exe
2596	Unicorn-50202.exe
2596	Unicorn-50202.exe
1796	Unicorn-31986.exe
1796	Unicorn-31986.exe
2728	Unicorn-25104.exe
2588	Unicorn-11369.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2728	Unicorn-25104.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2588	Unicorn-11369.exe
2936	Unicorn-1577.exe
2936	Unicorn-1577.exe
2496	Unicorn-33129.exe
2496	Unicorn-33129.exe
2700	Unicorn-43684.exe
2700	Unicorn-43684.exe
2392	Unicorn-15360.exe
2392	Unicorn-15360.exe
2596	Unicorn-50202.exe
2596	Unicorn-50202.exe
2680	Unicorn-48417.exe
2680	Unicorn-48417.exe
2728	Unicorn-25104.exe
2728	Unicorn-25104.exe
2876	Unicorn-37020.exe
2876	Unicorn-37020.exe
2700	Unicorn-43684.exe
2880	Unicorn-9614.exe
2700	Unicorn-43684.exe
2880	Unicorn-9614.exe
1924	Unicorn-56585.exe
1924	Unicorn-56585.exe
2496	Unicorn-33129.exe
2588	Unicorn-11369.exe
2496	Unicorn-33129.exe
2588	Unicorn-11369.exe
2324	Unicorn-56320.exe
608	Unicorn-44312.exe
2324	Unicorn-56320.exe
608	Unicorn-44312.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2936	Unicorn-1577.exe
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2936	Unicorn-1577.exe
2488	Unicorn-24982.exe
1796	Unicorn-31986.exe
2488	Unicorn-24982.exe
1796	Unicorn-31986.exe
2952	Unicorn-20967.exe
2952	Unicorn-20967.exe

Program crash 14 IoCs

pid	pid_target	Process	procid_target
7124	5496	WerFault.exe	481
7140	5480	WerFault.exe	476
7132	5540	WerFault.exe	482
7148	5512	WerFault.exe	479
7160	5768	WerFault.exe	484
5960	5336	WerFault.exe	471
5332	5900	WerFault.exe	485
6152	5324	WerFault.exe	472
6156	5344	WerFault.exe	474
6216	5500	WerFault.exe	477
6192	5448	WerFault.exe	475
6232	5516	WerFault.exe	480
6260	5600	WerFault.exe	483
6252	5364	WerFault.exe	473

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2072	7ace76588c8ad5e6667a70d40751c420N.exe
2496	Unicorn-33129.exe
1796	Unicorn-31986.exe
2700	Unicorn-43684.exe
2596	Unicorn-50202.exe
2728	Unicorn-25104.exe
2936	Unicorn-1577.exe
2588	Unicorn-11369.exe
2392	Unicorn-15360.exe
2680	Unicorn-48417.exe
2876	Unicorn-37020.exe
2880	Unicorn-9614.exe
2324	Unicorn-56320.exe
608	Unicorn-44312.exe
2488	Unicorn-24982.exe
1924	Unicorn-56585.exe
2568	Unicorn-32089.exe
2952	Unicorn-20967.exe
300	Unicorn-32473.exe
1176	Unicorn-54792.exe
1524	Unicorn-3775.exe
688	Unicorn-36640.exe
812	Unicorn-30509.exe
1268	Unicorn-44808.exe
2296	Unicorn-61263.exe
2132	Unicorn-61528.exe
880	Unicorn-43278.exe
2444	Unicorn-41662.exe
2164	Unicorn-61528.exe
1556	Unicorn-52208.exe
316	Unicorn-32342.exe
1708	Unicorn-46078.exe
2644	Unicorn-28602.exe
2504	Unicorn-63504.exe
2248	Unicorn-17288.exe
2668	Unicorn-4097.exe
2664	Unicorn-37154.exe
1276	Unicorn-22738.exe
1888	Unicorn-271.exe
1036	Unicorn-64154.exe
2520	Unicorn-38690.exe
1736	Unicorn-3531.exe
2960	Unicorn-40309.exe
644	Unicorn-39468.exe
2236	Unicorn-64237.exe
2176	Unicorn-12275.exe
1684	Unicorn-52924.exe
3028	Unicorn-44372.exe
580	Unicorn-47901.exe
924	Unicorn-62700.exe
1652	Unicorn-39157.exe
1380	Unicorn-40117.exe
3052	Unicorn-10931.exe
284	Unicorn-47133.exe
2800	Unicorn-50267.exe
2812	Unicorn-30666.exe
344	Unicorn-38965.exe
2012	Unicorn-55301.exe
2848	Unicorn-50532.exe
2828	Unicorn-2466.exe
2612	Unicorn-11803.exe
3016	Unicorn-2873.exe
1628	Unicorn-29985.exe
2000	Unicorn-44092.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2496	2072	7ace76588c8ad5e6667a70d40751c420N.exe	30
PID 2072 wrote to memory of 2496	2072	7ace76588c8ad5e6667a70d40751c420N.exe	30
PID 2072 wrote to memory of 2496	2072	7ace76588c8ad5e6667a70d40751c420N.exe	30
PID 2072 wrote to memory of 2496	2072	7ace76588c8ad5e6667a70d40751c420N.exe	30
PID 2072 wrote to memory of 1796	2072	7ace76588c8ad5e6667a70d40751c420N.exe	32
PID 2072 wrote to memory of 1796	2072	7ace76588c8ad5e6667a70d40751c420N.exe	32
PID 2072 wrote to memory of 1796	2072	7ace76588c8ad5e6667a70d40751c420N.exe	32
PID 2072 wrote to memory of 1796	2072	7ace76588c8ad5e6667a70d40751c420N.exe	32
PID 2496 wrote to memory of 2700	2496	Unicorn-33129.exe	31
PID 2496 wrote to memory of 2700	2496	Unicorn-33129.exe	31
PID 2496 wrote to memory of 2700	2496	Unicorn-33129.exe	31
PID 2496 wrote to memory of 2700	2496	Unicorn-33129.exe	31
PID 1796 wrote to memory of 2596	1796	Unicorn-31986.exe	33
PID 1796 wrote to memory of 2596	1796	Unicorn-31986.exe	33
PID 1796 wrote to memory of 2596	1796	Unicorn-31986.exe	33
PID 1796 wrote to memory of 2596	1796	Unicorn-31986.exe	33
PID 2700 wrote to memory of 2936	2700	Unicorn-43684.exe	34
PID 2700 wrote to memory of 2936	2700	Unicorn-43684.exe	34
PID 2700 wrote to memory of 2936	2700	Unicorn-43684.exe	34
PID 2700 wrote to memory of 2936	2700	Unicorn-43684.exe	34
PID 2072 wrote to memory of 2728	2072	7ace76588c8ad5e6667a70d40751c420N.exe	35
PID 2072 wrote to memory of 2728	2072	7ace76588c8ad5e6667a70d40751c420N.exe	35
PID 2072 wrote to memory of 2728	2072	7ace76588c8ad5e6667a70d40751c420N.exe	35
PID 2072 wrote to memory of 2728	2072	7ace76588c8ad5e6667a70d40751c420N.exe	35
PID 2496 wrote to memory of 2588	2496	Unicorn-33129.exe	36
PID 2496 wrote to memory of 2588	2496	Unicorn-33129.exe	36
PID 2496 wrote to memory of 2588	2496	Unicorn-33129.exe	36
PID 2496 wrote to memory of 2588	2496	Unicorn-33129.exe	36
PID 2596 wrote to memory of 2392	2596	Unicorn-50202.exe	37
PID 2596 wrote to memory of 2392	2596	Unicorn-50202.exe	37
PID 2596 wrote to memory of 2392	2596	Unicorn-50202.exe	37
PID 2596 wrote to memory of 2392	2596	Unicorn-50202.exe	37
PID 1796 wrote to memory of 608	1796	Unicorn-31986.exe	38
PID 1796 wrote to memory of 608	1796	Unicorn-31986.exe	38
PID 1796 wrote to memory of 608	1796	Unicorn-31986.exe	38
PID 1796 wrote to memory of 608	1796	Unicorn-31986.exe	38
PID 2728 wrote to memory of 2680	2728	Unicorn-25104.exe	39
PID 2728 wrote to memory of 2680	2728	Unicorn-25104.exe	39
PID 2728 wrote to memory of 2680	2728	Unicorn-25104.exe	39
PID 2728 wrote to memory of 2680	2728	Unicorn-25104.exe	39
PID 2072 wrote to memory of 2324	2072	7ace76588c8ad5e6667a70d40751c420N.exe	41
PID 2072 wrote to memory of 2324	2072	7ace76588c8ad5e6667a70d40751c420N.exe	41
PID 2072 wrote to memory of 2324	2072	7ace76588c8ad5e6667a70d40751c420N.exe	41
PID 2072 wrote to memory of 2324	2072	7ace76588c8ad5e6667a70d40751c420N.exe	41
PID 2588 wrote to memory of 1924	2588	Unicorn-11369.exe	40
PID 2588 wrote to memory of 1924	2588	Unicorn-11369.exe	40
PID 2588 wrote to memory of 1924	2588	Unicorn-11369.exe	40
PID 2588 wrote to memory of 1924	2588	Unicorn-11369.exe	40
PID 2936 wrote to memory of 2488	2936	Unicorn-1577.exe	42
PID 2936 wrote to memory of 2488	2936	Unicorn-1577.exe	42
PID 2936 wrote to memory of 2488	2936	Unicorn-1577.exe	42
PID 2936 wrote to memory of 2488	2936	Unicorn-1577.exe	42
PID 2496 wrote to memory of 2880	2496	Unicorn-33129.exe	43
PID 2496 wrote to memory of 2880	2496	Unicorn-33129.exe	43
PID 2496 wrote to memory of 2880	2496	Unicorn-33129.exe	43
PID 2496 wrote to memory of 2880	2496	Unicorn-33129.exe	43
PID 2700 wrote to memory of 2876	2700	Unicorn-43684.exe	44
PID 2700 wrote to memory of 2876	2700	Unicorn-43684.exe	44
PID 2700 wrote to memory of 2876	2700	Unicorn-43684.exe	44
PID 2700 wrote to memory of 2876	2700	Unicorn-43684.exe	44
PID 2392 wrote to memory of 2568	2392	Unicorn-15360.exe	45
PID 2392 wrote to memory of 2568	2392	Unicorn-15360.exe	45
PID 2392 wrote to memory of 2568	2392	Unicorn-15360.exe	45
PID 2392 wrote to memory of 2568	2392	Unicorn-15360.exe	45

C:\Users\Admin\AppData\Local\Temp\7ace76588c8ad5e6667a70d40751c420N.exe
"C:\Users\Admin\AppData\Local\Temp\7ace76588c8ad5e6667a70d40751c420N.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30574.exe
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6194.exe
        9⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
        9⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        9⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18617.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        8⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60293.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30180.exe
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        8⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        8⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25284.exe
        7⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35145.exe
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50697.exe
        6⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        7⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 188
        8⤵
        Program crash
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55301.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53724.exe
        7⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60283.exe
        6⤵
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57019.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        6⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        5⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3775.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38690.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61975.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        7⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19909.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        6⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20206.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        7⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 188
        8⤵
        Program crash
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33125.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65187.exe
        6⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29027.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        6⤵
        
        PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        5⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        6⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 188
        7⤵
        Program crash
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        5⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        5⤵
        
        PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        5⤵
        
        PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30709.exe
      4⤵
      PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        5⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8808.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 188
        6⤵
        Program crash
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22919.exe
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
      4⤵
      PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56585.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64196.exe
        7⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36631.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        7⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29121.exe
        6⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        7⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        6⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54289.exe
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61364.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15462.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        6⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19333.exe
        5⤵
        
        PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        5⤵
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        5⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        5⤵
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        5⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 188
        6⤵
        Program crash
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51722.exe
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8480.exe
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      4⤵
      PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        6⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        7⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        7⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3119.exe
        6⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        6⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        6⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        6⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 188
        7⤵
        Program crash
        
        PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        5⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
        5⤵
        
        PID:4016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61710.exe
        5⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        6⤵
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27745.exe
        5⤵
        
        PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
      4⤵
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        5⤵
        
        PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        5⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 188
        6⤵
        Program crash
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
      4⤵
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe
        5⤵
        
        PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        5⤵
        
        PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44799.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3567.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 188
        6⤵
        Program crash
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38155.exe
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64226.exe
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
      4⤵
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
    3⤵
    PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-161.exe
      4⤵
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36879.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46192.exe
    3⤵
    PID:5984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4097.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47486.exe
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32090.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13848.exe
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-901.exe
        7⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        7⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 188
        8⤵
        Program crash
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        6⤵
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        6⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9650.exe
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        5⤵
        Executes dropped EXE
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        5⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44092.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        7⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9526.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        8⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        8⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 188
        9⤵
        Program crash
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64164.exe
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        7⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        6⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48424.exe
        6⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        7⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25406.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30194.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1679.exe
        5⤵
        
        PID:896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
        5⤵
        
        PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        5⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
        5⤵
        
        PID:268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        5⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30647.exe
        5⤵
        
        PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        5⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14155.exe
        5⤵
        
        PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      4⤵
      PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5086.exe
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45307.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
        6⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17615.exe
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18805.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20650.exe
      4⤵
      PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
      4⤵
      PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47824.exe
      4⤵
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
      4⤵
      PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46078.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20761.exe
        5⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        6⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        6⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61425.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
      4⤵
      PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53008.exe
        5⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24869.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
      4⤵
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14362.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 188
        6⤵
        Program crash
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3558.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      4⤵
      PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
    3⤵
    PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
    3⤵
    PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
    3⤵
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        6⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57969.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        6⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28486.exe
        5⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        5⤵
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40816.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17288.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        5⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        6⤵
        
        PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1688.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22895.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60488.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39542.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34295.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26683.exe
        6⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49230.exe
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18017.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        5⤵
        
        PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62516.exe
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
      4⤵
      PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48415.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        6⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25191.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23443.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35113.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53438.exe
      4⤵
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41633.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        5⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        5⤵
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22565.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-271.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49479.exe
        5⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        5⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
      4⤵
      PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33357.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      4⤵
      PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
    3⤵
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43942.exe
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      4⤵
      PID:5540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 188
        5⤵
        Program crash
        
        PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8672.exe
    3⤵
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2628.exe
    3⤵
    PID:6920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61528.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        6⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51360.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
        5⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
      4⤵
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6910.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56296.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58203.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17692.exe
      4⤵
      PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
      4⤵
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      4⤵
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46945.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:5512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 188
        6⤵
        Program crash
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5047.exe
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44152.exe
      4⤵
      PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
      4⤵
      PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
      4⤵
      PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15488.exe
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55993.exe
    3⤵
    PID:6068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
      4⤵
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1623.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21819.exe
      4⤵
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
      4⤵
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46184.exe
      4⤵
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 188
        5⤵
        Program crash
        
        PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41481.exe
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25513.exe
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
    3⤵
    PID:6044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
    3⤵
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1124.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11975.exe
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51168.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
      4⤵
      PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
    3⤵
    PID:5920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
  2⤵
  PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
    3⤵
    PID:1080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34208.exe
  2⤵
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
  2⤵
  PID:5968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-25104.exe

Filesize
468KB

MD5
33bc680a3b8a94580901d0b455845751

SHA1
4b9ddbfc1a7a1e559427fddd828c6596cd0b1106

SHA256
4083d48be9eec49b66addf47afda24e381cc237cb27f9ada5584d3a69e9cc4b4

SHA512
fed4bd165554db3b2a0e30f4cb4b3659e03e7300198b5aed21b58aeba86eacb9d8e1ccdf2da8c00f7e4a10c02fd92523f5f6e1b48398bc5e851e61fb0ce349bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe

Filesize
468KB

MD5
c6caf0413b60cb2fdc61c2a1a8d8b7fc

SHA1
03508578966097910592bffeb7e269ee31ca30a1

SHA256
de4261c1cbb11d6a7b2ff01426780b70162d46be578b5438274688d4721bdb34

SHA512
0e6a062f1d92693d81646719e41d549fca2f0e48d4a8dc470e628d8df21486c6d575a2c83604b2bc049c87e862ff258b031155b9c3874cebd2dc11078d5cb001

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe

Filesize
468KB

MD5
d095d9584e077a1c6e509b43e8b274e7

SHA1
8e8ba770ba3344ae891e7f706dc71f7eec8d5146

SHA256
64512ef0e5eb09dbc09a04b986f1b4a0b0fa1de7ee312d766c93643f9bddc1a0

SHA512
dd705156898fc9693ea1983d3156ab18d56ee71d514d27e5a8361c394072fa5bfbe77823ae25c5c29f9f6d65d01f5a834425fb9829ce2510daf0363af23f9283

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe

Filesize
468KB

MD5
ca0ccf2571cbd3ef84714eb589a5e43a

SHA1
c710ab96c3bceb5686cb5a2f9b0d80cefae922e0

SHA256
edf665d60b957d1393301c1737ea89f36459d5e71127eea4d8449790c6256d1a

SHA512
7cb04b2ebb3547c95e9c31a5e67981771db7989524fa405a0b362776596f4d4d220b3ff7fa8f977b63cc9e6e44d7e878949616f8053a101c1030630de13f3b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5867.exe

Filesize
468KB

MD5
232b2b0d78fba8af028ac87adfcf2c10

SHA1
5b774e1cf680af15d6b950c5db3af78ff9cbe002

SHA256
70a9fa4261aff1c97a4cd3608ffd70d16d117af4ab96927e64ae707803c16d0d

SHA512
2da05483282f1d422a0c4aec2474e524e64ed54e83634ae1e87dcc3483e55de61c0c743cdc8631040161992cf9c7a216bd8655a4b7339e1007acd188b0beb328

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-11369.exe

Filesize
468KB

MD5
da4eee32a6655cea5058272da03e32f6

SHA1
05e4f93903e136ee5318d5d09251dfae95c5cf86

SHA256
f40536b102e4f247b2ec202f5db627cc2be94fe9002d2cb40ceac2fc0d2e9b51

SHA512
b128ff535ed719eeb077c5ccd7c21767763dbcd838b8cd81162d106dcb6954927b475e7a790fa72cbd44296310718f51e676fd0a46b60b8b59b0b39bb9582857

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15360.exe

Filesize
468KB

MD5
b9bf62d5336e39ce53110d039b622a15

SHA1
3299bb8963a78849732ca79d7020ae68e421a748

SHA256
a95dd35bcaae5123d8fe28ca1afd01f8d5f7dc07ea735092a95756ff26c1e270

SHA512
16dc5644f9803b48d8d6a21399045bd75fb96dd02fc78ff329df76bda2a76135051e8bb018fd179f722d74ca4ca5ad2f0bacabb73a408fb54a58847e39971eda

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe

Filesize
468KB

MD5
ada5513e3add3cf3d632af61c3970bb2

SHA1
d02b4eb8019b5d4bee0a2e2da6558549dab5b742

SHA256
f05ec0d7a7b53a9cf5fc01b2e02152956e211f0ff613f15033f194fffb408801

SHA512
2d67a358a79df2b89b5434c1f682213f759204b73fb615538b605c45596f14c9f90e9d83575830878555a0d88ccef2ad94a218229fdd230f22b9142318ae7867

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-20967.exe

Filesize
468KB

MD5
b98f0fb76794a2aea83fc612aaa8729c

SHA1
2736d7c84673aa77baa68588b7c0958887ea7350

SHA256
fcffe04f84004444ed1c7ee949f754e3888c3e4bfa6d9be3ae32168a63827e82

SHA512
edb779224406101af2d47597677540d1b9da40422a8ae66522d3a571dbbd8378f56d0c4ea45fe00801cc5ab8e8674c7e448aeb0a0d15a8385e4631c80801e19b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe

Filesize
468KB

MD5
ac5e3f9d49f0514994681751e09f24d1

SHA1
d1487106f03619e97b1c9af694c508819d808ac2

SHA256
0cb770ff81826fbe5db3959828702f3572d22437794f853a0027a204f20a000b

SHA512
c22bad12db340ccc8d1483f3b5a830a38e19590b2902014cfda600a63396c6e05f84d06cbe0a13700c93c24b92ed791486bb190d0c37f14d064d663581f1c701

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31986.exe

Filesize
468KB

MD5
50d5fcc6824d4fc589c03772314d485e

SHA1
41c6e9cd4676877fe64b10de99cc15b8d2a5fbe8

SHA256
a499092634820857363ade07c2afef28cf6c8c28a33d225936d3389eec86def8

SHA512
91f7a9d579c93c823e86e137f7ff5fc5caa21ddec12fff434327e36fa3f2e850fbd464bd79403c19428565cee6b190d11ace1af4ace387418b918924aa0f284b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32089.exe

Filesize
468KB

MD5
7443a480ed723ba34bd35a592f00ea82

SHA1
6709f89c5d9b61dcd4ebbbb2336efbef7adb12e5

SHA256
7882b476eea2f3d3814ce4b45ac83e9638461336cc2a03ed8d8ea03abbe9c17b

SHA512
98442a83349bfbd28a8657935c8ed0a8cdaa19267acf9f6c6253d934abc8796e780e239a578a5f59f6311f0bbef825e056103738a8c04b595e1751ac201f6e4a

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe

Filesize
468KB

MD5
8e6805f4c730bf86b58892e74ba363a7

SHA1
5af51c1f9ab02e9aa5d8b1c52335d7955ded1307

SHA256
30e5d798081102b683f3d7187ffdab77278865ffeba499b192637203d7da3cef

SHA512
5fb4b577cb57675ba6dd3aee96387805216e2d3d981a44c61a338dbbdba9e9664213c16d4aa140cfabe1982b69b4a4caaba3f446bde532cd58b150b19588d412

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe

Filesize
468KB

MD5
ff0dfdaf2444a48fbdf81d7bf1ce7172

SHA1
69304cb676b7597cb56db10540dcd0136d6d596b

SHA256
d6434942f55077d18772dd11ee36718e9f2cdd1dc0f8bf87cc9398e9cf8900ac

SHA512
ac422764dd963560e0418c7e893105a70e541bf1d8ae1cc4c82f01d1f1ca4c261b737940636e21672810b3dac0652b9c3d5dee7065f31a5e752264ecd46ab129

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-44312.exe

Filesize
468KB

MD5
1da45f5874076560255d0d9f3beb9e50

SHA1
1c5ac1d68b90ae74095713fa152e5ac1602199e8

SHA256
c99bc871e7fabb87a107229dd527e613bc0de78a8732c55445d79514fedc2bac

SHA512
6536b86faeffc1c5013ab2eaddec91c1d7957ff1c1df322b3875d3331463dd9ae05d3e79b7a0cbd184fd3e2b195ddf4dabf96de1dee2c84a90b0c98adc381109

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe

Filesize
468KB

MD5
dbc5401dfef5bc7a070d34187e3cce84

SHA1
bc824ce5e47f03e68d200fe1f8f3afd89d64634c

SHA256
e0752aa1265d092f63a5517fda68caa737211c4651f5d68475901fd8e338f70c

SHA512
2f66ff0686b6af9445feaf8633079527026284e75bf53e92bf2290d11a3b7bfa86a6b9373fd0f05cd05b8fd8b52729bd3f6e28fbc287f89c96e049f0cc8607ba

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-50202.exe

Filesize
468KB

MD5
b5aaee9761e73835573cf4df2360ae18

SHA1
ff37432a52fd2d83c49e9f52bc76382df8b523f0

SHA256
b80c45609de00f9c7137693c5fdb0532db3efd5b61eff17e8f6b88df718abb7a

SHA512
6d17c5ce2945677607069d3a134de39ecae8b4b8efde0e4607b46eb027b8e23d0186f479e9e513049e2ac7d5a2e064d02ca79a32c6c50368e4cf91888df4a76e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe

Filesize
468KB

MD5
c8781e95e386154ad190fb2f74d696eb

SHA1
d48519b5981dd9fcbab9ece8d1b366d11af99e7f

SHA256
bc64715f03c0fd1b69d6664c9c7a89fbf5fa9f8f3865d8203eacf32472e71a0d

SHA512
27895abf56bdcfe2bd6a11d868812ee5e8a4acc0523bab644db9de4017bf2789b57b707426c80e4719043bc2aca7ca4d10a95f69b076c97c9923a7846fc30c6f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56585.exe

Filesize
468KB

MD5
1ebff067f60d314edfe4ada2daed9ae9

SHA1
5410d91b7c54fae7423328ad25192c3a8e3b3db7

SHA256
49faf5cb66a6b7d4ec9dabbecf794f1b3d7969bb75c1d64d0b5b58a4e8997cde

SHA512
14d9178ea3a6912db2deb842782d5c1e695b5784eec5a6ea38e4fedab1d1af8555d707906860156d990e6e29bf4ee758f2fea110638a8682b1afbde580da8a1e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe

Filesize
468KB

MD5
c4364da258eda35a68b76593c78df6f7

SHA1
0dfce45a932415ef6af229953cfa9e158391ddd0

SHA256
5268c4b3f59125ea391e80c3ea022b12bab83ba6f53815b7cbb46bee612e6f71

SHA512
5411fe2fc32b64721796157847b0ad1efe6d59246552f5a5a9ffd49d95ad929f65172b85cf82b1853f11f13434fa0e8aaa23450ccee433e67d48da7af8369074

Download Submit
memory/300-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/300-385-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/300-377-0x00000000025C0000-0x0000000002635000-memory.dmp

Filesize
468KB

Download
memory/316-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/608-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/608-291-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/688-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/688-421-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/688-422-0x00000000028F0000-0x0000000002965000-memory.dmp

Filesize
468KB

Download
memory/812-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-402-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1176-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-401-0x0000000001E10000-0x0000000001E85000-memory.dmp

Filesize
468KB

Download
memory/1268-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-428-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1524-432-0x00000000026E0000-0x0000000002755000-memory.dmp

Filesize
468KB

Download
memory/1556-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1708-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-313-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1796-326-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1796-43-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/1796-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-285-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/1924-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-267-0x0000000002890000-0x0000000002905000-memory.dmp

Filesize
468KB

Download
memory/2072-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-144-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2072-300-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2072-12-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2072-6-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2072-141-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2132-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-292-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2324-290-0x0000000002680000-0x00000000026F5000-memory.dmp

Filesize
468KB

Download
memory/2392-197-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2392-196-0x0000000001CE0000-0x0000000001D55000-memory.dmp

Filesize
468KB

Download
memory/2444-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-312-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2488-324-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2488-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-287-0x00000000025E0000-0x0000000002655000-memory.dmp

Filesize
468KB

Download
memory/2496-156-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2496-164-0x0000000001D10000-0x0000000001D85000-memory.dmp

Filesize
468KB

Download
memory/2504-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-369-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2568-368-0x00000000025B0000-0x0000000002625000-memory.dmp

Filesize
468KB

Download
memory/2588-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-289-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2588-145-0x0000000003200000-0x0000000003275000-memory.dmp

Filesize
468KB

Download
memory/2588-288-0x0000000003400000-0x0000000003475000-memory.dmp

Filesize
468KB

Download
memory/2596-210-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2596-366-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2596-365-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2596-89-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2596-211-0x00000000025D0000-0x0000000002645000-memory.dmp

Filesize
468KB

Download
memory/2644-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-224-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2680-225-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2680-378-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2680-386-0x00000000023F0000-0x0000000002465000-memory.dmp

Filesize
468KB

Download
memory/2700-251-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-261-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-174-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-168-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2700-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-236-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2728-142-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2728-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-140-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2728-412-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2728-411-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2728-235-0x0000000000480000-0x00000000004F5000-memory.dmp

Filesize
468KB

Download
memory/2876-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-242-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2876-246-0x0000000002880000-0x00000000028F5000-memory.dmp

Filesize
468KB

Download
memory/2880-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-260-0x0000000002610000-0x0000000002685000-memory.dmp

Filesize
468KB

Download
memory/2936-147-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2936-148-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2936-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-311-0x00000000024A0000-0x0000000002515000-memory.dmp

Filesize
468KB

Download
memory/2952-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-351-0x0000000001DE0000-0x0000000001E55000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads