1d8f4f59c723865be4e9a8701fb5f6d13cf16530044f2345f2f0e5dceb429bf9

Analysis

max time kernel
152s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99721baed09b96343793712b3e60519e.exe
Size

184KB
MD5

99721baed09b96343793712b3e60519e
SHA1

106cc76c87fc2138ca438499fd6c5294d3e435b1
SHA256

1d8f4f59c723865be4e9a8701fb5f6d13cf16530044f2345f2f0e5dceb429bf9
SHA512

1f2e78a3a61d0ba920002b0ee4f5f241b2aad79d5e55977383cd44c3f3612bf116cfc5bb1bc784fded81a884ec22e8e2cc0c6882c80858567bcc846d9553e85d
SSDEEP

3072:oJ1JocsNAcEAOjZu8pcUzFMOBR6vHYIOgYx8QPbV7lPdpFJ:oJ/oB6LAquwcUzklpU7lPdpF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2716	Unicorn-3441.exe
2780	Unicorn-29072.exe
2900	Unicorn-58023.exe
2640	Unicorn-60805.exe
2648	Unicorn-19581.exe
2888	Unicorn-65252.exe
476	Unicorn-60587.exe
2996	Unicorn-3965.exe
2136	Unicorn-27915.exe
1496	Unicorn-49679.exe
1180	Unicorn-42065.exe
2852	Unicorn-27204.exe
2644	Unicorn-8682.exe
980	Unicorn-36524.exe
1636	Unicorn-8490.exe
1772	Unicorn-28356.exe
892	Unicorn-32802.exe
2768	Unicorn-56752.exe
2348	Unicorn-56389.exe
2948	Unicorn-60836.exe
2408	Unicorn-43945.exe
1556	Unicorn-15911.exe
2544	Unicorn-56882.exe
1952	Unicorn-45974.exe
564	Unicorn-33338.exe
828	Unicorn-13472.exe
312	Unicorn-62118.exe
2352	Unicorn-17364.exe
2932	Unicorn-37230.exe
1808	Unicorn-58397.exe
1708	Unicorn-35943.exe
760	Unicorn-44858.exe
2332	Unicorn-3270.exe
2700	Unicorn-55979.exe
2152	Unicorn-39643.exe
2984	Unicorn-19777.exe
2608	Unicorn-20567.exe
1824	Unicorn-25013.exe
2556	Unicorn-40795.exe
548	Unicorn-37073.exe
580	Unicorn-45455.exe
2384	Unicorn-6238.exe
2912	Unicorn-26104.exe
1224	Unicorn-59331.exe
2960	Unicorn-25912.exe
764	Unicorn-11438.exe
540	Unicorn-2715.exe
1640	Unicorn-44132.exe
2364	Unicorn-11459.exe
1552	Unicorn-11267.exe
1380	Unicorn-41287.exe
2356	Unicorn-65237.exe
1484	Unicorn-10727.exe
2216	Unicorn-59181.exe
1492	Unicorn-9959.exe
1560	Unicorn-56747.exe
1764	Unicorn-58776.exe
1108	Unicorn-54500.exe
824	Unicorn-17381.exe
2916	Unicorn-4744.exe
636	Unicorn-5299.exe
1324	Unicorn-50224.exe
896	Unicorn-17189.exe
992	Unicorn-38185.exe

Loads dropped DLL 64 IoCs

pid	Process
1876	99721baed09b96343793712b3e60519e.exe
1876	99721baed09b96343793712b3e60519e.exe
2716	Unicorn-3441.exe
2716	Unicorn-3441.exe
1876	99721baed09b96343793712b3e60519e.exe
1876	99721baed09b96343793712b3e60519e.exe
2780	Unicorn-29072.exe
2780	Unicorn-29072.exe
2900	Unicorn-58023.exe
2900	Unicorn-58023.exe
2716	Unicorn-3441.exe
2716	Unicorn-3441.exe
2648	Unicorn-19581.exe
2648	Unicorn-19581.exe
2900	Unicorn-58023.exe
2900	Unicorn-58023.exe
2888	Unicorn-65252.exe
2888	Unicorn-65252.exe
2640	Unicorn-60805.exe
2640	Unicorn-60805.exe
2780	Unicorn-29072.exe
2780	Unicorn-29072.exe
476	Unicorn-60587.exe
476	Unicorn-60587.exe
2648	Unicorn-19581.exe
2648	Unicorn-19581.exe
1496	Unicorn-49679.exe
1496	Unicorn-49679.exe
2640	Unicorn-60805.exe
2136	Unicorn-27915.exe
2136	Unicorn-27915.exe
2640	Unicorn-60805.exe
2888	Unicorn-65252.exe
2888	Unicorn-65252.exe
1180	Unicorn-42065.exe
1180	Unicorn-42065.exe
2852	Unicorn-27204.exe
2852	Unicorn-27204.exe
476	Unicorn-60587.exe
476	Unicorn-60587.exe
2644	Unicorn-8682.exe
2644	Unicorn-8682.exe
2996	Unicorn-3965.exe
2996	Unicorn-3965.exe
1636	Unicorn-8490.exe
1636	Unicorn-8490.exe
1772	Unicorn-28356.exe
1772	Unicorn-28356.exe
892	Unicorn-32802.exe
892	Unicorn-32802.exe
2136	Unicorn-27915.exe
2136	Unicorn-27915.exe
980	Unicorn-36524.exe
980	Unicorn-36524.exe
1496	Unicorn-49679.exe
1496	Unicorn-49679.exe
2768	Unicorn-56752.exe
1180	Unicorn-42065.exe
2768	Unicorn-56752.exe
1180	Unicorn-42065.exe
2348	Unicorn-56389.exe
2348	Unicorn-56389.exe
2852	Unicorn-27204.exe
2852	Unicorn-27204.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1092	2860	WerFault.exe	106
2336	1252	WerFault.exe	255
1956	1076	WerFault.exe	354

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1876	99721baed09b96343793712b3e60519e.exe
2716	Unicorn-3441.exe
2780	Unicorn-29072.exe
2900	Unicorn-58023.exe
2648	Unicorn-19581.exe
2640	Unicorn-60805.exe
2888	Unicorn-65252.exe
476	Unicorn-60587.exe
1496	Unicorn-49679.exe
1180	Unicorn-42065.exe
2136	Unicorn-27915.exe
2996	Unicorn-3965.exe
2852	Unicorn-27204.exe
2644	Unicorn-8682.exe
980	Unicorn-36524.exe
1636	Unicorn-8490.exe
892	Unicorn-32802.exe
1772	Unicorn-28356.exe
2768	Unicorn-56752.exe
2348	Unicorn-56389.exe
2948	Unicorn-60836.exe
2408	Unicorn-43945.exe
1556	Unicorn-15911.exe
2544	Unicorn-56882.exe
1952	Unicorn-45974.exe
564	Unicorn-33338.exe
828	Unicorn-13472.exe
312	Unicorn-62118.exe
2932	Unicorn-37230.exe
2352	Unicorn-17364.exe
1808	Unicorn-58397.exe
1708	Unicorn-35943.exe
760	Unicorn-44858.exe
2332	Unicorn-3270.exe
2700	Unicorn-55979.exe
2984	Unicorn-19777.exe
2152	Unicorn-39643.exe
2608	Unicorn-20567.exe
2556	Unicorn-40795.exe
1824	Unicorn-25013.exe
548	Unicorn-37073.exe
580	Unicorn-45455.exe
2912	Unicorn-26104.exe
2384	Unicorn-6238.exe
2960	Unicorn-25912.exe
1224	Unicorn-59331.exe
764	Unicorn-11438.exe
540	Unicorn-2715.exe
1640	Unicorn-44132.exe
2364	Unicorn-11459.exe
1552	Unicorn-11267.exe
1380	Unicorn-41287.exe
2356	Unicorn-65237.exe
1484	Unicorn-10727.exe
992	Unicorn-38185.exe
1560	Unicorn-56747.exe
896	Unicorn-17189.exe
824	Unicorn-17381.exe
1324	Unicorn-50224.exe
2916	Unicorn-4744.exe
1492	Unicorn-9959.exe
1108	Unicorn-54500.exe
2216	Unicorn-59181.exe
636	Unicorn-5299.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2716	1876	99721baed09b96343793712b3e60519e.exe	28
PID 1876 wrote to memory of 2716	1876	99721baed09b96343793712b3e60519e.exe	28
PID 1876 wrote to memory of 2716	1876	99721baed09b96343793712b3e60519e.exe	28
PID 1876 wrote to memory of 2716	1876	99721baed09b96343793712b3e60519e.exe	28
PID 2716 wrote to memory of 2780	2716	Unicorn-3441.exe	29
PID 2716 wrote to memory of 2780	2716	Unicorn-3441.exe	29
PID 2716 wrote to memory of 2780	2716	Unicorn-3441.exe	29
PID 2716 wrote to memory of 2780	2716	Unicorn-3441.exe	29
PID 1876 wrote to memory of 2900	1876	99721baed09b96343793712b3e60519e.exe	30
PID 1876 wrote to memory of 2900	1876	99721baed09b96343793712b3e60519e.exe	30
PID 1876 wrote to memory of 2900	1876	99721baed09b96343793712b3e60519e.exe	30
PID 1876 wrote to memory of 2900	1876	99721baed09b96343793712b3e60519e.exe	30
PID 2780 wrote to memory of 2640	2780	Unicorn-29072.exe	31
PID 2780 wrote to memory of 2640	2780	Unicorn-29072.exe	31
PID 2780 wrote to memory of 2640	2780	Unicorn-29072.exe	31
PID 2780 wrote to memory of 2640	2780	Unicorn-29072.exe	31
PID 2900 wrote to memory of 2648	2900	Unicorn-58023.exe	33
PID 2900 wrote to memory of 2648	2900	Unicorn-58023.exe	33
PID 2900 wrote to memory of 2648	2900	Unicorn-58023.exe	33
PID 2900 wrote to memory of 2648	2900	Unicorn-58023.exe	33
PID 2716 wrote to memory of 2888	2716	Unicorn-3441.exe	32
PID 2716 wrote to memory of 2888	2716	Unicorn-3441.exe	32
PID 2716 wrote to memory of 2888	2716	Unicorn-3441.exe	32
PID 2716 wrote to memory of 2888	2716	Unicorn-3441.exe	32
PID 2648 wrote to memory of 476	2648	Unicorn-19581.exe	34
PID 2648 wrote to memory of 476	2648	Unicorn-19581.exe	34
PID 2648 wrote to memory of 476	2648	Unicorn-19581.exe	34
PID 2648 wrote to memory of 476	2648	Unicorn-19581.exe	34
PID 2900 wrote to memory of 2996	2900	Unicorn-58023.exe	35
PID 2900 wrote to memory of 2996	2900	Unicorn-58023.exe	35
PID 2900 wrote to memory of 2996	2900	Unicorn-58023.exe	35
PID 2900 wrote to memory of 2996	2900	Unicorn-58023.exe	35
PID 2888 wrote to memory of 2136	2888	Unicorn-65252.exe	36
PID 2888 wrote to memory of 2136	2888	Unicorn-65252.exe	36
PID 2888 wrote to memory of 2136	2888	Unicorn-65252.exe	36
PID 2888 wrote to memory of 2136	2888	Unicorn-65252.exe	36
PID 2640 wrote to memory of 1496	2640	Unicorn-60805.exe	37
PID 2640 wrote to memory of 1496	2640	Unicorn-60805.exe	37
PID 2640 wrote to memory of 1496	2640	Unicorn-60805.exe	37
PID 2640 wrote to memory of 1496	2640	Unicorn-60805.exe	37
PID 2780 wrote to memory of 1180	2780	Unicorn-29072.exe	38
PID 2780 wrote to memory of 1180	2780	Unicorn-29072.exe	38
PID 2780 wrote to memory of 1180	2780	Unicorn-29072.exe	38
PID 2780 wrote to memory of 1180	2780	Unicorn-29072.exe	38
PID 476 wrote to memory of 2852	476	Unicorn-60587.exe	39
PID 476 wrote to memory of 2852	476	Unicorn-60587.exe	39
PID 476 wrote to memory of 2852	476	Unicorn-60587.exe	39
PID 476 wrote to memory of 2852	476	Unicorn-60587.exe	39
PID 2648 wrote to memory of 2644	2648	Unicorn-19581.exe	40
PID 2648 wrote to memory of 2644	2648	Unicorn-19581.exe	40
PID 2648 wrote to memory of 2644	2648	Unicorn-19581.exe	40
PID 2648 wrote to memory of 2644	2648	Unicorn-19581.exe	40
PID 1496 wrote to memory of 980	1496	Unicorn-49679.exe	41
PID 1496 wrote to memory of 980	1496	Unicorn-49679.exe	41
PID 1496 wrote to memory of 980	1496	Unicorn-49679.exe	41
PID 1496 wrote to memory of 980	1496	Unicorn-49679.exe	41
PID 2136 wrote to memory of 1772	2136	Unicorn-27915.exe	42
PID 2136 wrote to memory of 1772	2136	Unicorn-27915.exe	42
PID 2136 wrote to memory of 1772	2136	Unicorn-27915.exe	42
PID 2136 wrote to memory of 1772	2136	Unicorn-27915.exe	42
PID 2640 wrote to memory of 1636	2640	Unicorn-60805.exe	43
PID 2640 wrote to memory of 1636	2640	Unicorn-60805.exe	43
PID 2640 wrote to memory of 1636	2640	Unicorn-60805.exe	43
PID 2640 wrote to memory of 1636	2640	Unicorn-60805.exe	43

C:\Users\Admin\AppData\Local\Temp\99721baed09b96343793712b3e60519e.exe
"C:\Users\Admin\AppData\Local\Temp\99721baed09b96343793712b3e60519e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50224.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        9⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60393.exe
        10⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        11⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64685.exe
        12⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2324.exe
        13⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        14⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        15⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56396.exe
        16⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        17⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        18⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        19⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3480.exe
        20⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe
        18⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        19⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22059.exe
        20⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
        10⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37249.exe
        11⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        12⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36139.exe
        13⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        14⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11663.exe
        15⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        16⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        8⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 220
        9⤵
        Program crash
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10727.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
        8⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        9⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        10⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55666.exe
        11⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        12⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        13⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        14⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56882.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20567.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11267.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
        9⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
        10⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        11⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        12⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53019.exe
        13⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        14⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        15⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65137.exe
        16⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37735.exe
        17⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29116.exe
        18⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        19⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        16⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        17⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        14⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        15⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        16⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        17⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        18⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        19⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exe
        10⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        11⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        12⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
        13⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        14⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        15⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        8⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        9⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
        10⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        11⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
        12⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        13⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
        14⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32645.exe
        15⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
        10⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32894.exe
        11⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25013.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59181.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33481.exe
        8⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
        9⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        10⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        11⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37654.exe
        12⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33202.exe
        13⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        14⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43096.exe
        15⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        16⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
        10⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        11⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        12⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        13⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        14⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        15⤵
        
        PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37230.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        8⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
        9⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
        10⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        11⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        12⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56419.exe
        13⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exe
        14⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        15⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        16⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        7⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        8⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        9⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58551.exe
        10⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        11⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51935.exe
        12⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21761.exe
        13⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43895.exe
        14⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
        15⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        9⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
        10⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        11⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        12⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        13⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11623.exe
        9⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65479.exe
        10⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        11⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        12⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        13⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        14⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36978.exe
        15⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9178.exe
        16⤵
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38185.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47212.exe
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58343.exe
        9⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        10⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
        11⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        12⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        13⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        14⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25525.exe
        15⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        6⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62806.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55998.exe
        8⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34281.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        10⤵
        
        PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40795.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7440.exe
        9⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        10⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        11⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        12⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        13⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        14⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        15⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        16⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5286.exe
        17⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62645.exe
        9⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30160.exe
        10⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4358.exe
        11⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        12⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41401.exe
        13⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31934.exe
        14⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
        7⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42848.exe
        8⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        9⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        10⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        11⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28457.exe
        12⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37073.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4744.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        8⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        9⤵
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        10⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        11⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        12⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7330.exe
        13⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        14⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13472.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26104.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19275.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29589.exe
        8⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27192.exe
        9⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        10⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        11⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        12⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        13⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
        14⤵
        
        PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exe
        7⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33533.exe
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        9⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57830.exe
        10⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        11⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29567.exe
        12⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37102.exe
        13⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57704.exe
        14⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        15⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        16⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40768.exe
        6⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11384.exe
        8⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
        9⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        10⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41518.exe
        11⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        12⤵
        
        PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6238.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18917.exe
        6⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10066.exe
        8⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        9⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
        10⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        11⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        12⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        13⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62026.exe
        14⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51352.exe
        15⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        16⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2100.exe
        8⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28671.exe
        9⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        10⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        11⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        12⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        13⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        14⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8566.exe
        7⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        8⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe
        9⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        10⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        11⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57662.exe
        12⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6754.exe
        13⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 188
        14⤵
        Program crash
        
        PID:1956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56389.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35943.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        8⤵
        
        PID:528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
        9⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        10⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        11⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8536.exe
        12⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35250.exe
        13⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9959.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        9⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        10⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53580.exe
        11⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        12⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        13⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        14⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58524.exe
        15⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        16⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        8⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        9⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63450.exe
        10⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        11⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42330.exe
        12⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33350.exe
        13⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        14⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        15⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60014.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        9⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
        10⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65490.exe
        11⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        12⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        13⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        14⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        9⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        10⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32418.exe
        11⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        12⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        13⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        14⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        15⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58939.exe
        16⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32453.exe
        17⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        15⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9016.exe
        12⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        13⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
        9⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        10⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23206.exe
        11⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        12⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        13⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
        14⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26381.exe
        7⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36657.exe
        8⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
        9⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16445.exe
        10⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49688.exe
        11⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        12⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        13⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        14⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        15⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
        9⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        10⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
        11⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        12⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        13⤵
        
        PID:312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
        14⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        8⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        9⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20550.exe
        10⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26679.exe
        11⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58430.exe
        12⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65000.exe
        13⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe
        14⤵
        
        PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        8⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
        9⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        10⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22942.exe
        11⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        12⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55656.exe
        13⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        14⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        15⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15131.exe
        11⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        12⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        13⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 200
        14⤵
        Program crash
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        9⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16995.exe
        10⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        11⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7773.exe
        12⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        13⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
        14⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10454.exe
        15⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        9⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40441.exe
        10⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        11⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        12⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        10⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38576.exe
        11⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        12⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        13⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        14⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        15⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51710.exe
        12⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4248.exe
        13⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11459.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36989.exe
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29257.exe
        9⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26699.exe
        10⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
        11⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        12⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
        13⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        14⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23190.exe
        15⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3324.exe
        14⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        15⤵
        
        PID:936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15911.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36029.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54270.exe
        8⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12002.exe
        9⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        10⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31591.exe
        11⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        12⤵
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        13⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3589.exe
        14⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        12⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12863.exe
        6⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50238.exe
        8⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19092.exe
        9⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        10⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        11⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        12⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        13⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27793.exe
        14⤵
        
        PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13931.exe

Filesize
184KB

MD5
d0bab02ae07beef86959b0ae2990eb93

SHA1
e3088813a1737de8b993527bd9f16d886ace4129

SHA256
68832ffb19430df3616d89735177b882a4cdbf8e01a0409d94bb706e83c8ecc9

SHA512
4a8ba26a528bc048452632d9e46dd7224583f771235e88927ace52cbd04e6a39ae7d27c9f822036b72765033b9c3d55bfd18fd3eba8944a1bcc518516305e281

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe

Filesize
184KB

MD5
e96dd2d54cc73bfdfb6c1d8a66e25abe

SHA1
1d4c36dde758cf9843ddcd20fa4fb4f75e26f994

SHA256
5de65b5ca86a4f8b4a6bfbd1358e84cf9fcc47395d17637578a0bc53b3bf9892

SHA512
8d9612ba90463e8d77503c3b92c99865e8604848f31542e0be8d12fad3b2d6f7ec51ca5a69ee988aa7788b67123ce60a693b6ffc35b75d666bd92812199d1848

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2687.exe

Filesize
184KB

MD5
1734c43894dc0debe4bcc81a17b80f89

SHA1
4d94c4e267443f8fb7619f247eeb2936e88e8adb

SHA256
48c6a7de65f35fcd8cc538515c49f1713c280846ff5a1142c293ba5b22d23235

SHA512
5544862aa37447a6e65582fb9d196f6b78c8bc6d2e1c51ab19e802540e1f444ba94acd6d1739fb84e655ac872e93e8ee063761ec5cc6d10c8baf7fdcc4ca0a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe

Filesize
184KB

MD5
a4a60b54206ceb6bca43808192e34ec1

SHA1
3d30b6707e77569f139c13a667d0a39c3c52ffcb

SHA256
c0449d13320e58b89ce077556b08eb683cfb253fb3b55f698972a66da4d93875

SHA512
76c2e838575ae638fd8fc2fc1c01ec671164477a7a3c9b35ee67cefa56fa19279e632953462f02a5889a3de70b0403658a41736daffe35a76051e0c32e760638

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe

Filesize
184KB

MD5
38cdf9bd15645cf07f03f249ae97866f

SHA1
7532c6183619296a8c1e0c8b4fe469d8344486b9

SHA256
12ac6ca362222ac83f21a1ceb26dc4a145da72acc97e4302a41bf99407980cb7

SHA512
b37559675220ca76e736b3bc1e94222bd97696c3d3403102a655a4bed6903ad9b8543bfcbdcb858ca2201db98932254b84e68784df5361ea17b97e04fb718140

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40272.exe

Filesize
184KB

MD5
e0b17ff10e9e855662bae8eb6044734d

SHA1
f0cd0cb1c496862067372ed640e45073d522ae70

SHA256
ed61ba09a05df3ac0b3f31dfbf99c1961751176fd616c5f0500959f91a8a628e

SHA512
fbcbf8cb1bd84feb9e49e1d8740de36e61bd635920b30c87265dd91dd2263cebf12b03d7507fe5450a88f7df7d71eba91e680a36d6077d33d827fd5f171f3bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe

Filesize
184KB

MD5
9433c1d6a7222459cdf289d691da694d

SHA1
f7642594aaab29afc71ec9a3b30fca585e4d2862

SHA256
1fd3c6e19636cc7a9331f9eb1b1d2a12b551f1c0be97eab34c47210faca42402

SHA512
e5432f0a16b6ea40594d932dd35ed18759bc89937128ee091d67c3f464a66dbcec622c4d2c8b93bec35e997ce78521541ab529e20eb18ef4df6dc68d7b71546a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe

Filesize
184KB

MD5
6ade749f6bf1f7a6e2c6d5c5b4b1e2f6

SHA1
44478d5a458396345f43d8a14116e47fe3517758

SHA256
30b8c0c206ba4599940f0584bf82725c11c758df79f520304bb098f8c5030674

SHA512
9959de14a5565e2764f84bcce266245e19d4b773d4fd380c8036f03c9087f1d284b14fccce9f326e7cf9529d27d79640adf7b0c8ac7e1d9469cac1f737e3a7a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe

Filesize
184KB

MD5
cb5cbf3af2a1e44b5c2a3967c04011d9

SHA1
ca1d5abfc856813d405529dafc953fb83add26cb

SHA256
6ca74da37cd2445027ae022e217851a633c497b0ecda1d7808f0fb2d0cf56185

SHA512
b12dfc1f53965189c8084478b891e3d5c7e4afa0783dfa6e62a7231709b86c99a74f41c7bfe1441301d3814e50c910e05ad26f3f0486c4021c09dfb6cc4f19fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe

Filesize
184KB

MD5
6612434f7682ad3637425928196a3202

SHA1
8bb52ca5d8d02ca737384e26238fd01b59eac8a2

SHA256
fa8d6bf9d591582c6ca51fff6b12f18a925c34671b6ea52311257bb8347453e2

SHA512
55316675c420f99c662887b9aec6c04941cda284b5c90344eb3798aa6e237252cbfca562a789aebed3771bc56c6c4046c847ff4260426a8f75bc25a0fc7cbc74

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe

Filesize
184KB

MD5
f6b69ed0ea4b1c5c0ec7c1566f5effa6

SHA1
c4f60418da978024135b452216f728769b5cc3af

SHA256
31b1d44b7a31f07658ec6ed34183190ce0541fb42aa231e907670305c44685d8

SHA512
9f9f9ec9204d8c331bd0f0b67955cc871f55f4bc6f732c87db2a4c209373a63335f4cf0e7eedc6f82927692d217503e01bdf4cde9c634e0d664d30680f6ea969

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe

Filesize
175KB

MD5
a649f94571ec34f46c0ce22d69359b56

SHA1
8268c84bfc0db6d3fd22578b2282911fc6117f30

SHA256
4fa2b35eb857fb52e117d1bcf5ee782ee9e8baabae3a7abe28ceb58698679539

SHA512
e0eaa8e8be737fc2e884aee67b5cf2efaca4b76747716bf0fbcaf29d209348298b977b20d9ae0730aa36800dd2a3ea7e1474b8ffdfde2db33aac444deb7b47b7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27204.exe

Filesize
184KB

MD5
f66a4c2ae0b53b9f37b09149a7346376

SHA1
7991b30741aec69cb56cb003edf517d207ab6ee3

SHA256
903d93499c9c964f62393b2d7e3fd9546284ffb26dc951a5ce1af183583e1f1f

SHA512
ed85e96720b3ac1ab74520632409d10e18dc29f5bef3127759db41e57833cce11b645ab40c2dd734e3525ab1a2be5ece31c5e9dc0e5dbe670578611be7816021

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe

Filesize
184KB

MD5
38653859e4de31b497f9c5b4dbeae2fa

SHA1
356f8601dce37b2e4e9397db09fc0ea8edc504b0

SHA256
37d96fe87ee0e3b7162698787fcd17c9e974293bf4fb77686566b0c8b6fbc1b7

SHA512
69d5e9a3b7327dac00a2fa32036dc5ef0a93140a27d0eced95db808bfc92b271c939341b40ae053c80d303d488d3fca9b6ebca53d134b8d3d57a95c2c47f0db8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-29072.exe

Filesize
184KB

MD5
b918757cc009a4b35715d054f215a95b

SHA1
d0fa6eef890aec47408d1f9731049650d134baf9

SHA256
16940c99107c79bf486076570dd05a44bae75713338a6ab55a04bba7846f9887

SHA512
b0ec3632a600af737342417f7d6c28c89e85af4035ed9f54852e5130d369f1660045d337cf553e73866bad90c588ecce413375b59ef89dd0fee42d51666d5f06

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32802.exe

Filesize
184KB

MD5
387fcd4c00e0ca54c5b3ba801d439ece

SHA1
0eb9fcd3d7b1dd818b2108939596de901282510f

SHA256
288b0e78d6904fc92d02e6a9f00784c7ad8a1e975ac8e98cf97997f6ef12db7a

SHA512
08480d470f9b759499c615808d8b6f8f3ba6b585979ac890a288f3973bd5cd12741589d0a89130e200883598ee78257f1c17e73c909bb2c33dcbbb65c845d706

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3441.exe

Filesize
184KB

MD5
5847114e3a87133c9f19151277f82f8d

SHA1
ac26f2316037e29f41cb2fc6d1e257b43094c229

SHA256
41bba7008dd352906cfed426d0f64f85f06643e6e64fd81fc3a2d43859b7fed1

SHA512
e8f5c3af506066a77a777fe1f0edd6d153bce77b4bb03ba185b0f375dfe72e8c5ff81cb60a210a3c00477cb3997782267fd8f8919b4600903ad100646b86b596

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe

Filesize
184KB

MD5
69462a77d03638ba3d08c5ffcd1b8234

SHA1
0205de48d836f06dc7deeda6bd1b2fa6f8de50be

SHA256
fbc373f83176946abf3d98d0b312ad3378787ec2539b5e4fa10534683be74e9b

SHA512
e4c376363e52a4cb4931c97d633a5564f27f77c749d6d83e9a8a09f300d456b6ac4b38f9862ebc300043cd1b4295198f9f1b5b13106ad71aaf10b948a1b89c97

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe

Filesize
184KB

MD5
b06f2a9ae923d9d795d8f37c75786a19

SHA1
2d6e1acddf889ccb9c1efa2051ad9dd8310d8eac

SHA256
49e90e7ecdce943fb639ea0c3fd7a342c5b0d12b626e14fed3102ec37df7db29

SHA512
34f6fe5e38e747c07f5547ec23d593ab4ff8294091ef43d12aad813af67a9795d99c069acdee2f13c7b4a6177d3020e5255390b9a899250bf9b27051ae509110

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-42065.exe

Filesize
184KB

MD5
cdec4d5ed6a113ed86cf0d5022eca0fa

SHA1
59211aa6fa2423fdf66086e7793e8dafcfc0bb20

SHA256
07290caad12cd77a9f8278d13cb3ce02258df8368d82dc26aea02f83c81f4813

SHA512
c6d328cf8b0c8bb1130a96a09e003c3dea8d29470acaa00b4bd447377167c646369915a5cf1ae12e6fac756f113592c979c63618811a69feac8ecf34bac68b07

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe

Filesize
184KB

MD5
a39273b92e94375d060dc488eda10c80

SHA1
67006012efa45bc7359cb26f136fd9a45632d2b8

SHA256
06f46063c42f08e17af8cf5b847d774f8b15f9277ba8a91287ed2014d82f4fd0

SHA512
8467e9eb6cf155fe228ee76fc401cfe398dba9a53a55ca55ca3c563c2b3e1eaaa47ab19ba87e18ce2a8996a2a2dfedf4ec78e10b7506135a067bed6dff4b8ab4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe

Filesize
184KB

MD5
17ce09bc1f758890e9a74f2f98a56ee5

SHA1
11e2fc6f32f0f3e011f3d965dd6240fe618b2ee9

SHA256
333bf1a000f0c75cb0f89a42563487135a9544ef191d968bd2d1200d296a8f2b

SHA512
fc6292791a47329a199e73a12e6a4c1d423cc0cc1f205a3f6e485ec7f99936b8062876d8f8cbc2e1f1d099299d8430719b25422e055fb9b0dd438f58af984ea4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-58023.exe

Filesize
184KB

MD5
c4c9ccea10148b5e0e059c5e8d92fafd

SHA1
62ce82f0a7c58091f6960bd05c09e9b707004990

SHA256
dc5469fc3a467b2c21cb155d9f605ca852b45ff52c3c3a55d26aa86dc5ecfae5

SHA512
bfd9ed53b23885b1cbcb6327bec54bad8c41d4a0135299efa92e6a66f1547bc735c6c6db823783c006fe4d0cd81f62a4cfc374a960c690562034fb006554bd1d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe

Filesize
184KB

MD5
337331e2b01daa5a36e30bc96b3e84fe

SHA1
796314e68495bb4449ad3ffdf935b1d7c1ab704d

SHA256
3a0041b497eda548b704fc564befe5bcc05d8e638854032d9c9658ff0aa72bd7

SHA512
bfd13f7a2f2b4342b7a2deb3f806b556e4aa3c466d45b6ca93edff75f65d584890440c03607f525963c660164db09159c94f25b377785b44045389e01300a785

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe

Filesize
184KB

MD5
cb00d490bcc7e35f0ca33d7023952c47

SHA1
fd3cc2a618d9c9b37fbc0bec9e73f1e6d0de9e85

SHA256
d62b0db8b2483f9d133dd32863c916337b6cb87eef93ccded15af0b55a480c55

SHA512
86d5e60c99ddc5e03208eebe4a96b611adaa100a8b1e3720bd77ac270648c00fc7383b811086cec88309902e737ceb60a1d80d518917f72f82a860aad0c6b19d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe

Filesize
184KB

MD5
2f2f24ab797c2e467d9a1d8e8ad1bcf3

SHA1
8c0a33061648f1037057d6ea7ef0ca10a14a2c5b

SHA256
ce98162849d83cf4e3aa5dfbfbe4e900995df9d54df1278a926501fd42c6329e

SHA512
f32f048b104f46f14472b5aceec13385b6e8fa63d6cacbdf7f6b87ab939ab96e6cfac37397f8bf8e96e627f3bd1c1a7a29a1248739d9624c4427e2f678713e19

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8490.exe

Filesize
184KB

MD5
c27fe5e2669ca43fd06a7b30aed5689f

SHA1
cce41a14bef4711f07c8c7acc8be6240c48c9b8e

SHA256
b78b3814462f0bba21454900c95432f1c52dc15118b5b807077c7427ad1980a5

SHA512
6c07a3a31180a7bd689b4a864e1ed412105c2dd71d2c421e3f13d2ac41fd17c92b0fe9513e9c4a008ae2cb002b99b7b34333a5656f2e95366ff29a072e9fc1ab

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8682.exe

Filesize
184KB

MD5
fee199bc96ec998e3b24db8ffd035bd2

SHA1
38b4ac3f6c9480180bb825267159ce147c14da54

SHA256
8de85ab015334cbc39a1220a47b32130568e0f380c80b853aff0f93c587cb85e

SHA512
7e85a46d0276a5be3383efd436a34716efd4da3281c1f564e41ed6d2ce9e5f92cf0e84f407dac359ab5a8e2cb55cc2497b3f29525f119f039ccadf6789013cf3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads