0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032

Analysis

max time kernel
145s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
Size

468KB
MD5

b6dc8e40e6e5fd5b7a54cc72439c38d0
SHA1

8d5461fd1c107005c66d1e066bc37dfab6692ab5
SHA256

0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032
SHA512

9594b0313160506dce43e0fb85b28a5344c6695b4b4d7efb8a8505f1779ab622d43a5647f7a367c5635f54d3c930b8a5cebd7affbb24792aee9ac5d4f2cf34d9
SSDEEP

3072:/nCHovUuU35/tbYAPgt5Of8/E55h6IXGXmHdxSxnKvQUYfHuf5lT:/nWoCJ/tLPM5Ofk27uKvpmHuf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
804	Unicorn-6565.exe
1880	Unicorn-13747.exe
2656	Unicorn-2818.exe
2492	Unicorn-59523.exe
2728	Unicorn-26750.exe
2676	Unicorn-2154.exe
2456	Unicorn-55994.exe
1964	Unicorn-37048.exe
588	Unicorn-17758.exe
1120	Unicorn-31402.exe
2896	Unicorn-4759.exe
2836	Unicorn-64166.exe
2228	Unicorn-62683.exe
2112	Unicorn-12927.exe
2792	Unicorn-41827.exe
2760	Unicorn-28448.exe
2916	Unicorn-40146.exe
1776	Unicorn-8926.exe
2192	Unicorn-60513.exe
2968	Unicorn-48169.exe
1876	Unicorn-19480.exe
2236	Unicorn-60421.exe
3032	Unicorn-6374.exe
1052	Unicorn-60421.exe
2080	Unicorn-34333.exe
1560	Unicorn-23473.exe
1008	Unicorn-28879.exe
976	Unicorn-48745.exe
1672	Unicorn-22103.exe
1680	Unicorn-2237.exe
608	Unicorn-7447.exe
940	Unicorn-20349.exe
2416	Unicorn-32601.exe
1900	Unicorn-59798.exe
1652	Unicorn-24241.exe
1812	Unicorn-18110.exe
1588	Unicorn-21479.exe
2052	Unicorn-61573.exe
1592	Unicorn-59170.exe
2608	Unicorn-46690.exe
2600	Unicorn-45728.exe
2652	Unicorn-5657.exe
2956	Unicorn-5657.exe
2908	Unicorn-2149.exe
2644	Unicorn-2149.exe
1444	Unicorn-43736.exe
2572	Unicorn-43736.exe
2484	Unicorn-2149.exe
2464	Unicorn-49767.exe
2472	Unicorn-50893.exe
2100	Unicorn-62648.exe
1568	Unicorn-44936.exe
2712	Unicorn-49020.exe
2784	Unicorn-57743.exe
1664	Unicorn-57856.exe
1656	Unicorn-14785.exe
2892	Unicorn-45512.exe
2808	Unicorn-45412.exe
1992	Unicorn-15069.exe
2832	Unicorn-21200.exe
2788	Unicorn-21200.exe
2672	Unicorn-21200.exe
1536	Unicorn-21200.exe
1488	Unicorn-1334.exe

Loads dropped DLL 64 IoCs

pid	Process
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
804	Unicorn-6565.exe
804	Unicorn-6565.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
2656	Unicorn-2818.exe
2656	Unicorn-2818.exe
1880	Unicorn-13747.exe
804	Unicorn-6565.exe
1880	Unicorn-13747.exe
804	Unicorn-6565.exe
2492	Unicorn-59523.exe
2492	Unicorn-59523.exe
2656	Unicorn-2818.exe
2656	Unicorn-2818.exe
2456	Unicorn-55994.exe
2456	Unicorn-55994.exe
2676	Unicorn-2154.exe
804	Unicorn-6565.exe
2676	Unicorn-2154.exe
804	Unicorn-6565.exe
1880	Unicorn-13747.exe
2728	Unicorn-26750.exe
2728	Unicorn-26750.exe
1880	Unicorn-13747.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
2492	Unicorn-59523.exe
1964	Unicorn-37048.exe
2492	Unicorn-59523.exe
1964	Unicorn-37048.exe
588	Unicorn-17758.exe
588	Unicorn-17758.exe
2656	Unicorn-2818.exe
2656	Unicorn-2818.exe
2228	Unicorn-62683.exe
2228	Unicorn-62683.exe
1880	Unicorn-13747.exe
1880	Unicorn-13747.exe
2792	Unicorn-41827.exe
2792	Unicorn-41827.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
2896	Unicorn-4759.exe
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
2896	Unicorn-4759.exe
2676	Unicorn-2154.exe
2676	Unicorn-2154.exe
1120	Unicorn-31402.exe
1120	Unicorn-31402.exe
2456	Unicorn-55994.exe
2456	Unicorn-55994.exe
2112	Unicorn-12927.exe
2112	Unicorn-12927.exe
2836	Unicorn-64166.exe
2836	Unicorn-64166.exe
2728	Unicorn-26750.exe
2728	Unicorn-26750.exe
804	Unicorn-6565.exe
804	Unicorn-6565.exe
2916	Unicorn-40146.exe
2916	Unicorn-40146.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4088	3560	WerFault.exe	257

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
804	Unicorn-6565.exe
2656	Unicorn-2818.exe
1880	Unicorn-13747.exe
2492	Unicorn-59523.exe
2676	Unicorn-2154.exe
2456	Unicorn-55994.exe
2728	Unicorn-26750.exe
1964	Unicorn-37048.exe
588	Unicorn-17758.exe
2228	Unicorn-62683.exe
1120	Unicorn-31402.exe
2112	Unicorn-12927.exe
2896	Unicorn-4759.exe
2792	Unicorn-41827.exe
2836	Unicorn-64166.exe
2760	Unicorn-28448.exe
2916	Unicorn-40146.exe
1776	Unicorn-8926.exe
2192	Unicorn-60513.exe
2968	Unicorn-48169.exe
3032	Unicorn-6374.exe
1876	Unicorn-19480.exe
2236	Unicorn-60421.exe
1052	Unicorn-60421.exe
2080	Unicorn-34333.exe
1560	Unicorn-23473.exe
1008	Unicorn-28879.exe
1680	Unicorn-2237.exe
976	Unicorn-48745.exe
1672	Unicorn-22103.exe
608	Unicorn-7447.exe
2416	Unicorn-32601.exe
940	Unicorn-20349.exe
1900	Unicorn-59798.exe
1812	Unicorn-18110.exe
1652	Unicorn-24241.exe
1588	Unicorn-21479.exe
2052	Unicorn-61573.exe
1592	Unicorn-59170.exe
2644	Unicorn-2149.exe
2608	Unicorn-46690.exe
2652	Unicorn-5657.exe
2956	Unicorn-5657.exe
2484	Unicorn-2149.exe
2908	Unicorn-2149.exe
1444	Unicorn-43736.exe
2572	Unicorn-43736.exe
2600	Unicorn-45728.exe
2100	Unicorn-62648.exe
2464	Unicorn-49767.exe
1568	Unicorn-44936.exe
2712	Unicorn-49020.exe
2472	Unicorn-50893.exe
2784	Unicorn-57743.exe
1664	Unicorn-57856.exe
1656	Unicorn-14785.exe
2892	Unicorn-45512.exe
1536	Unicorn-21200.exe
1992	Unicorn-15069.exe
2788	Unicorn-21200.exe
2832	Unicorn-21200.exe
2672	Unicorn-21200.exe
1488	Unicorn-1334.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 804	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 804	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 804	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 804	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	28
PID 804 wrote to memory of 1880	804	Unicorn-6565.exe	29
PID 804 wrote to memory of 1880	804	Unicorn-6565.exe	29
PID 804 wrote to memory of 1880	804	Unicorn-6565.exe	29
PID 804 wrote to memory of 1880	804	Unicorn-6565.exe	29
PID 1704 wrote to memory of 2656	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2656	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2656	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2656	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2728	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2728	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2728	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2728	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	31
PID 2656 wrote to memory of 2492	2656	Unicorn-2818.exe	32
PID 2656 wrote to memory of 2492	2656	Unicorn-2818.exe	32
PID 2656 wrote to memory of 2492	2656	Unicorn-2818.exe	32
PID 2656 wrote to memory of 2492	2656	Unicorn-2818.exe	32
PID 1880 wrote to memory of 2676	1880	Unicorn-13747.exe	33
PID 1880 wrote to memory of 2676	1880	Unicorn-13747.exe	33
PID 1880 wrote to memory of 2676	1880	Unicorn-13747.exe	33
PID 1880 wrote to memory of 2676	1880	Unicorn-13747.exe	33
PID 804 wrote to memory of 2456	804	Unicorn-6565.exe	34
PID 804 wrote to memory of 2456	804	Unicorn-6565.exe	34
PID 804 wrote to memory of 2456	804	Unicorn-6565.exe	34
PID 804 wrote to memory of 2456	804	Unicorn-6565.exe	34
PID 2492 wrote to memory of 1964	2492	Unicorn-59523.exe	35
PID 2492 wrote to memory of 1964	2492	Unicorn-59523.exe	35
PID 2492 wrote to memory of 1964	2492	Unicorn-59523.exe	35
PID 2492 wrote to memory of 1964	2492	Unicorn-59523.exe	35
PID 2656 wrote to memory of 588	2656	Unicorn-2818.exe	36
PID 2656 wrote to memory of 588	2656	Unicorn-2818.exe	36
PID 2656 wrote to memory of 588	2656	Unicorn-2818.exe	36
PID 2656 wrote to memory of 588	2656	Unicorn-2818.exe	36
PID 2456 wrote to memory of 1120	2456	Unicorn-55994.exe	37
PID 2456 wrote to memory of 1120	2456	Unicorn-55994.exe	37
PID 2456 wrote to memory of 1120	2456	Unicorn-55994.exe	37
PID 2456 wrote to memory of 1120	2456	Unicorn-55994.exe	37
PID 2676 wrote to memory of 2896	2676	Unicorn-2154.exe	38
PID 2676 wrote to memory of 2896	2676	Unicorn-2154.exe	38
PID 2676 wrote to memory of 2896	2676	Unicorn-2154.exe	38
PID 2676 wrote to memory of 2896	2676	Unicorn-2154.exe	38
PID 804 wrote to memory of 2836	804	Unicorn-6565.exe	39
PID 804 wrote to memory of 2836	804	Unicorn-6565.exe	39
PID 804 wrote to memory of 2836	804	Unicorn-6565.exe	39
PID 804 wrote to memory of 2836	804	Unicorn-6565.exe	39
PID 2728 wrote to memory of 2112	2728	Unicorn-26750.exe	41
PID 2728 wrote to memory of 2112	2728	Unicorn-26750.exe	41
PID 2728 wrote to memory of 2112	2728	Unicorn-26750.exe	41
PID 2728 wrote to memory of 2112	2728	Unicorn-26750.exe	41
PID 1880 wrote to memory of 2228	1880	Unicorn-13747.exe	40
PID 1880 wrote to memory of 2228	1880	Unicorn-13747.exe	40
PID 1880 wrote to memory of 2228	1880	Unicorn-13747.exe	40
PID 1880 wrote to memory of 2228	1880	Unicorn-13747.exe	40
PID 1704 wrote to memory of 2792	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2792	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2792	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2792	1704	0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe	42
PID 2492 wrote to memory of 2760	2492	Unicorn-59523.exe	43
PID 2492 wrote to memory of 2760	2492	Unicorn-59523.exe	43
PID 2492 wrote to memory of 2760	2492	Unicorn-59523.exe	43
PID 2492 wrote to memory of 2760	2492	Unicorn-59523.exe	43

C:\Users\Admin\AppData\Local\Temp\0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0af8ae64ff61a367fda10117f15e748aba7d80cb8e176bd55824dcd0165f7032_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        7⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
        8⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46947.exe
        8⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        8⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        7⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41064.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1334.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        7⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29309.exe
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38423.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        6⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34333.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45512.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30206.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29840.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        5⤵
        Executes dropped EXE
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18590.exe
        6⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41562.exe
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22492.exe
        5⤵
        
        PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15633.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        5⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59383.exe
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        7⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        6⤵
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58475.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32913.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
        6⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30874.exe
        5⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        5⤵
        
        PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        5⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        5⤵
        
        PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        6⤵
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        6⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29319.exe
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55299.exe
        5⤵
        
        PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        5⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        5⤵
        
        PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        5⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        5⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26875.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        5⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23518.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28615.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      4⤵
      PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3851.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        6⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        6⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61225.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48579.exe
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        6⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43469.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        5⤵
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        5⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        6⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18412.exe
        5⤵
        
        PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        5⤵
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
        5⤵
        
        PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        5⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        5⤵
        
        PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9423.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35433.exe
        5⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1557.exe
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
      4⤵
      PID:948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
      4⤵
      PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      4⤵
      PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        6⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        6⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        6⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11469.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        5⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
        5⤵
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30387.exe
        5⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45951.exe
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54442.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16736.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16484.exe
      4⤵
      PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
      4⤵
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
      4⤵
      PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9523.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2391.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63491.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38659.exe
        5⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        5⤵
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4807.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
      4⤵
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      4⤵
      PID:6128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62648.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
      4⤵
      PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe
      4⤵
      PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      4⤵
      PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1122.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
    3⤵
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1030.exe
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49143.exe
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
    3⤵
    PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18961.exe
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35758.exe
    3⤵
    PID:6016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        7⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64624.exe
        6⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60556.exe
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9056.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47553.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3295.exe
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        7⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
        6⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22084.exe
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6262.exe
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2226.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
        6⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        6⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38812.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60254.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50612.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        7⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6045.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        7⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22652.exe
        7⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        6⤵
        
        PID:472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        6⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37785.exe
        6⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57743.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        6⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27015.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        6⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        5⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3456.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11886.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37622.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        5⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29865.exe
        5⤵
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10129.exe
        5⤵
        
        PID:3560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 188
        6⤵
        Program crash
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        5⤵
        
        PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38013.exe
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
      4⤵
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48090.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45627.exe
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17758.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15610.exe
        7⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38779.exe
        7⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        6⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50107.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16887.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        5⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
        5⤵
        
        PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12015.exe
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
        5⤵
        
        PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        5⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        6⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        6⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
        6⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        6⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        5⤵
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19991.exe
        5⤵
        
        PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        5⤵
        
        PID:920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        5⤵
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
      4⤵
      PID:1408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43315.exe
        6⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36822.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34706.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19091.exe
        5⤵
        
        PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
      4⤵
      PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26519.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53809.exe
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
      4⤵
      PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        5⤵
        
        PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63929.exe
        5⤵
        
        PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
        5⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        5⤵
        
        PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
      4⤵
      PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55444.exe
      4⤵
      PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
      4⤵
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
      4⤵
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28923.exe
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
      4⤵
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
    3⤵
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11583.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55496.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
      4⤵
      PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11957.exe
      4⤵
      PID:6096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-368.exe
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
    3⤵
    PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22548.exe
    3⤵
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52290.exe
    3⤵
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27129.exe
    3⤵
    PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        5⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53418.exe
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37906.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
      4⤵
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46725.exe
      4⤵
      PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      4⤵
      PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25055.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19801.exe
        5⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4663.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
      4⤵
      PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22791.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57856.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
      4⤵
      PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
      4⤵
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54914.exe
      4⤵
      PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
      4⤵
      PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12294.exe
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51455.exe
    3⤵
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60415.exe
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
    3⤵
    PID:5348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60421.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        5⤵
        
        PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        5⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8889.exe
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15994.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57891.exe
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
      4⤵
      PID:5796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32989.exe
      4⤵
      PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28923.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20004.exe
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52590.exe
    3⤵
    PID:364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
    3⤵
    PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
    3⤵
    PID:4080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
    3⤵
    PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65524.exe
    3⤵
    PID:5784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
      4⤵
      PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
      4⤵
      PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11469.exe
    3⤵
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47410.exe
    3⤵
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29115.exe
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
    3⤵
    PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
    3⤵
    PID:5148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45728.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
    3⤵
    PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10641.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63664.exe
    3⤵
    PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
    3⤵
    PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
    3⤵
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57013.exe
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
  2⤵
  PID:1752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
  2⤵
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
  2⤵
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
  2⤵
  PID:5396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43156.exe
  2⤵
  PID:6120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe

Filesize
468KB

MD5
517a38c98579a06767817316678e480f

SHA1
cc5f56beffe587bb295055ffdb097504bdd9c4a4

SHA256
1eccf0e72ea059912e24e014ed19a6741a5f4af9079bbfd9d89a22cab9bcdc5d

SHA512
79e534b4dd34d485ed9f6646240d80dbc1321a4a4670d7ac5e7bf97f2ea2342155bf94f2da59d21bca052b535dc72e6edcd0e78235e8ee520499cdea9bdd8212

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe

Filesize
468KB

MD5
34788ff23844d92d881d50e5dbafe8b6

SHA1
b71f422628ba935df5dacca88d850b59a5483bc4

SHA256
fe648d101ac111a9bcaac1d2c9d055b513a23f52f3ed646678e575ee530940d8

SHA512
725bb66a04602ceb24bcfc02e27e0546ba9e1793e484adbcee094546e2f18e5e996de31b778066f38e83e837ff0d68a23503f4be4dc088ea96b9a38e229ebb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe

Filesize
468KB

MD5
bc8fe83c2929fc0d94fbd20a39bdf8c9

SHA1
571e140ffbca66d6b48258427e9826c39c5a4ae9

SHA256
f319ef79f93a5b27027d8281b2226100a6b145f92e84fa50dc7cb599fd2b5934

SHA512
ccdea1fd877feb9727b1b03e94cf07bed9ae041cdaaef88265de9d497f122643ae4f8a6aae478566dc81b91dbf7ef5be790fb3f8d19c3bbf4902036b79e3f80b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe

Filesize
468KB

MD5
f603e82ec69f804ca50502904227791d

SHA1
6b41e5aa0f428ec27eb83c8d878da57cd237e0c9

SHA256
65eb740c190986ff6baddb7c09790c9044f180a2ae2ba48821d3536ef09cc670

SHA512
7ccd368f32cbbf521191e413be724abb649978cb8d9b37d6b43ef3fa7fcc16aa58281ddac424d9b06b35f953d4165028055029443716c6fa286cd198c7ef179b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-13747.exe

Filesize
468KB

MD5
832c87d9d1f521a526a1280a2f569a74

SHA1
6b6f033e9267e7effb6e11aa1bbef7edf36c95de

SHA256
56ea084dd121ccecc4294aaa100aae25178c544b274b04ad2ea2169e7c5c3a1c

SHA512
8e297849d8ba9ee66b946c1b7dfe8b0e88c7e0370e56b9bca0194352adb03e610707061d30166163d222952a96831dc23eb420c58ea8a42e2c3f29342a0ef52c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17758.exe

Filesize
468KB

MD5
cbcaa74e153e76b0c7c184922e3178d8

SHA1
3300ab907142db9e94d186eb64651a9e7a9e36c2

SHA256
abd6271b36eb1c75d82ae7e9453dee688c508f8b325f06beb0473e05ba4b1b01

SHA512
39a166a1d9275184d65b3876614daa0d0d149728b00b02629b0b2f09be385f0dcaae8f7fc2f8e2022a814c37eb0619fe58811b3bf2cb8b20996ae2e9f9185e72

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2154.exe

Filesize
468KB

MD5
3e30440254585421a192e0d872d267ea

SHA1
8f85f80e62cb78ee14196262a395bbbb8192b716

SHA256
fa62ab761e02d223928fad67deca2604e6a36a84f9d7536b1348d20ab3ea25a7

SHA512
773cd4de6879879ad9357fe7a89ca9535c9c1e1dd0d120840eec736bcac94788dc332204c07f6c8687c2bc10e4037f0178b5a4ddc6a0c1185a17a10530143641

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-26750.exe

Filesize
468KB

MD5
2d6eea2d04a091d8b55358fd28549666

SHA1
4408d4a7d3ea2dd18ff5b3a0b6e41fc877149c33

SHA256
7aae5a2fab64c240ffc18a6454989c197a196a3484f8c84d00b4cbfa28826cdc

SHA512
4303eba7e2d35c22e0c3e34abebd4fac9eff11af8979afe4a72b52abb6a570c517a15bf3b4825e83ddd31312984e1d62cb06fe5057a654a5694ee93e1bf63886

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe

Filesize
468KB

MD5
cd33a0d92e4b29a5acc93989c4d3f7eb

SHA1
4a0138d1722d2f373f206af15406c4f7db676aff

SHA256
c1aa2a806bc8e6fa4f13af722e6f06f5823b2bcb4cda4d919382b1d65372adb6

SHA512
9ca111b4fc4c8a3c7cb4ab2cd2e81e4f4d041438528ae6a0df290bae34af7a7e683d4b2a360a47951647cdf02927f1d28314d7eb5e4149a3a911c83ef892b810

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-28448.exe

Filesize
468KB

MD5
8bd2d5b8839f5b77909ed51e7cfbb05c

SHA1
beb22473bc65d9e0fed3c2a74ee299449dcfe4c3

SHA256
450b8e9334a1f6239cbce332d97b014ad25e42997647e27b67f4dbde0150433f

SHA512
cb62c438bc490893f6fcd9a402cdde8846c125ea7c637f2dc15d61965a9d06786f76ec4d0e8fb09f3623841480ba4ddec4b25b929d793d6cc5a1ee0af0418670

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31402.exe

Filesize
468KB

MD5
96b290099141927fbeef8f69cd0533d7

SHA1
d35fe62c903260b20da0da8323557c100c291be7

SHA256
3f2161af90ccfa07db6852fc2d9fb1dff6d672ace36ed0a7808eaa6db8aa7cf8

SHA512
4a2f44831bb2a7f87994d40478131827250105af9ed4f09097c72b60208308474f4174649b474a0b6d3f7202161ce2799742e92ed59220a889e6eb17c83faefa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe

Filesize
468KB

MD5
9a7c522682fdc1a8c02f328f446caf29

SHA1
cba13f681c894fbd0a713c6624da476c951476ca

SHA256
5ecb0ad1733ad0749a4deac2b68126055a03bb4d33ccaeb359b206a9a054d9df

SHA512
6d9a90d93295698613fb221483f40e800f05d9f1419f367c16b8ef54165f79d6174e855d6feca9f3b65d186d3b2c400d5ee0536969bf189832b4678952c520a5

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe

Filesize
468KB

MD5
8a15c559b9d74e275ff4c561832eea4c

SHA1
ca62e8c1c5754e11442a0cb8992393c4d61fdaa8

SHA256
e0b18f44b0ec15fb9839545ea7c61b749bf0675933a89a53ddef55f65c7424b3

SHA512
38b6840783dc40066f5cff1190e9b7db879ddad69e19e5dd1c464f06e48b73442b39e407d2bdfeba4c3ee412b206c71c10ff5bce64ffc1dc0f2486d8f47104f8

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41827.exe

Filesize
468KB

MD5
3221c1dae4841ad81574f204cf116fa0

SHA1
4c4eba4ea7eba04e3a5dc9f22d1f3a0813acb04b

SHA256
725e0da027c68cb7acb638170a0ff88ace1371e9831ea621d272e5189478e613

SHA512
ccd9924d8400ea0ee212e1889c27ddaf5d27de93d78a41aefcc612ea2963480382427faf0dc84ead4a0ad7473149a43b5f4ac9aebd03eb269acf871b1a44ddad

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe

Filesize
468KB

MD5
05f29c4bef76a820c34da95bcde470a1

SHA1
a9273c745dd05cd3cb7522d7aaf8a2992fec5012

SHA256
28c24bb97620340a8c2f7befae598fedd476f5e236316245d652835499ed7b49

SHA512
d1bf9018bdff3469cee580056dcb7cb82a368e605dc82fd7ecb0bf863fe3df0ad2c8eed69a755995de75fe9fbf7094c9489322ccc48f58572e2af4c600c45458

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe

Filesize
468KB

MD5
1d847ee01c383c844f2249c5e525b666

SHA1
671a28d79c686ea4b35fc079131b1c1e4a14903a

SHA256
4dd11eff40559ebfd8e543d7be2af1bbc154c54f5003068a0214e1bfa657352f

SHA512
8c88ec5e52f0c5533e8614d41fb76917da5a4451337fe7628ef038b686fefc6c145a0e2b5e0257635ca39f6f33625d03f40f2277804616afad0521b4448b8f14

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe

Filesize
468KB

MD5
980c5de6282e9b56594abf63b674283c

SHA1
e8ac32722b3cf35c0978b80d07258b8453252065

SHA256
478dd07a6292ba1c3d6256e7e0875ed71a5019c66df217c140daa3dc784f056e

SHA512
3243e168d2a1bd2417b8a49be7b26eec2b8e1767aaca18a2ef86e4dd8c689e91ff259d90684879b384338d299244f494ee6bd602b57457a0a039f5a160cbf379

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe

Filesize
468KB

MD5
3ef6b25bc0dfef3f10a970f896a0be3c

SHA1
3268725f23c0f1b7f7ac51d7ff1f3540e6f7788d

SHA256
439b225cf0ab015f5bb89c5cbf83854009210e4731a2e26e1b9eb9e0b7d94757

SHA512
898e8b0f12b4721e90611c0a5892ee56b2ccc6601c3f218ed4beb4fae257edb96ec17237910c125071f2bac7442dbc4045040b47046038932e090daeae2c0e15

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe

Filesize
468KB

MD5
fec311596a04488fb1beaa0e3998e557

SHA1
c905b6ee97cd8b5f93c9d9d0bc1d7ab20cae8a12

SHA256
7cb116568e3f16818ced3adc51acece1374cf9bf1c067d363e71115794507d8d

SHA512
9aa008e4eabe092831106b8c52f698f0498780d57db357320a8404a94e7b0d3f962d96fa8b1f35c96a3b89780ec5e08adbbe39d72a49806bc8fa1ad9515b169b

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe

Filesize
468KB

MD5
f1c91aababecb8e4656e82b65536a7cc

SHA1
db40e31ce577c28575985bc5172e81b07dc33631

SHA256
a2b24fb30ee79ad9903635b5cfe9372bdd36eb3b1e03644d52aec7cce255c384

SHA512
4a1268bfd57b2d72e5861b0c9bd85ac089fdae18b0f8f4c5fa4a1bd1c0e1c0d02eb842822858e153af24ac79e783bb9138fa549d19e8295e90390d9164d628ab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads