4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
Size

468KB
MD5

1ebf241ccbdaf4ee61099016d61e097e
SHA1

955235376cd132f054ae6c744090c568a4014d50
SHA256

4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1
SHA512

c26b89b2ec982f6b804b59fa90c4aca6ace9b7c8ec4feb51b4ccbfbbe1b96cd81731ff32906b6f057a0a91532fef960dce84ad10b7ee3307584e90197eb5d485
SSDEEP

3072:KbZ2og/dIf5UsrYJ/ztGcf8/ECVCPIiwnmHexVhPla88Plquk5lV:Kb4ovBUs+/JGcfLLKVlal9quk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2456	Unicorn-41791.exe
2624	Unicorn-54967.exe
2736	Unicorn-57660.exe
2892	Unicorn-16924.exe
2568	Unicorn-395.exe
1684	Unicorn-55718.exe
808	Unicorn-27592.exe
2584	Unicorn-24983.exe
1496	Unicorn-54894.exe
1816	Unicorn-41895.exe
2424	Unicorn-41795.exe
2416	Unicorn-47925.exe
2832	Unicorn-48236.exe
1480	Unicorn-47110.exe
1036	Unicorn-62891.exe
972	Unicorn-17151.exe
2900	Unicorn-16405.exe
1848	Unicorn-59445.exe
2124	Unicorn-62874.exe
2592	Unicorn-44884.exe
2164	Unicorn-25647.exe
604	Unicorn-34578.exe
1652	Unicorn-65204.exe
960	Unicorn-46638.exe
2444	Unicorn-50722.exe
2320	Unicorn-47105.exe
1960	Unicorn-52393.exe
1664	Unicorn-6529.exe
1760	Unicorn-5714.exe
1776	Unicorn-29664.exe
992	Unicorn-2829.exe
1992	Unicorn-2564.exe
2280	Unicorn-37893.exe
1708	Unicorn-43177.exe
2452	Unicorn-3275.exe
2208	Unicorn-21579.exe
888	Unicorn-21579.exe
2640	Unicorn-45891.exe
2792	Unicorn-19559.exe
2984	Unicorn-8127.exe
2788	Unicorn-15339.exe
2580	Unicorn-19908.exe
2264	Unicorn-43650.exe
2204	Unicorn-59378.exe
2148	Unicorn-32544.exe
2064	Unicorn-24275.exe
428	Unicorn-52964.exe
880	Unicorn-18821.exe
1536	Unicorn-45464.exe
1188	Unicorn-61708.exe
2812	Unicorn-23990.exe
2872	Unicorn-41096.exe
1720	Unicorn-34874.exe
1868	Unicorn-23289.exe
1620	Unicorn-29420.exe
2076	Unicorn-39534.exe
3020	Unicorn-15584.exe
2112	Unicorn-63716.exe
1784	Unicorn-52341.exe
1284	Unicorn-24629.exe
1644	Unicorn-13768.exe
2020	Unicorn-58262.exe
1060	Unicorn-6460.exe
2000	Unicorn-12590.exe

Loads dropped DLL 64 IoCs

pid	Process
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2456	Unicorn-41791.exe
2456	Unicorn-41791.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2624	Unicorn-54967.exe
2624	Unicorn-54967.exe
2736	Unicorn-57660.exe
2736	Unicorn-57660.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2456	Unicorn-41791.exe
2456	Unicorn-41791.exe
2568	Unicorn-395.exe
2568	Unicorn-395.exe
2736	Unicorn-57660.exe
2736	Unicorn-57660.exe
808	Unicorn-27592.exe
808	Unicorn-27592.exe
2456	Unicorn-41791.exe
2892	Unicorn-16924.exe
2456	Unicorn-41791.exe
2892	Unicorn-16924.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2624	Unicorn-54967.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2624	Unicorn-54967.exe
2584	Unicorn-24983.exe
2584	Unicorn-24983.exe
2568	Unicorn-395.exe
2568	Unicorn-395.exe
1496	Unicorn-54894.exe
1496	Unicorn-54894.exe
1684	Unicorn-55718.exe
1684	Unicorn-55718.exe
2736	Unicorn-57660.exe
2736	Unicorn-57660.exe
2832	Unicorn-48236.exe
2832	Unicorn-48236.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
1480	Unicorn-47110.exe
1480	Unicorn-47110.exe
2624	Unicorn-54967.exe
2624	Unicorn-54967.exe
2424	Unicorn-41795.exe
2424	Unicorn-41795.exe
2416	Unicorn-47925.exe
2416	Unicorn-47925.exe
2456	Unicorn-41791.exe
2456	Unicorn-41791.exe
2892	Unicorn-16924.exe
2892	Unicorn-16924.exe
1816	Unicorn-41895.exe
1816	Unicorn-41895.exe
808	Unicorn-27592.exe
808	Unicorn-27592.exe
2124	Unicorn-62874.exe
2124	Unicorn-62874.exe
1036	Unicorn-62891.exe
2736	Unicorn-57660.exe
1036	Unicorn-62891.exe
2736	Unicorn-57660.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	3020	WerFault.exe	85

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
2456	Unicorn-41791.exe
2624	Unicorn-54967.exe
2736	Unicorn-57660.exe
2568	Unicorn-395.exe
2892	Unicorn-16924.exe
808	Unicorn-27592.exe
1684	Unicorn-55718.exe
2584	Unicorn-24983.exe
1496	Unicorn-54894.exe
2424	Unicorn-41795.exe
1480	Unicorn-47110.exe
2416	Unicorn-47925.exe
2832	Unicorn-48236.exe
1816	Unicorn-41895.exe
1036	Unicorn-62891.exe
972	Unicorn-17151.exe
2900	Unicorn-16405.exe
1848	Unicorn-59445.exe
2124	Unicorn-62874.exe
2592	Unicorn-44884.exe
2164	Unicorn-25647.exe
604	Unicorn-34578.exe
1652	Unicorn-65204.exe
960	Unicorn-46638.exe
2444	Unicorn-50722.exe
2320	Unicorn-47105.exe
1960	Unicorn-52393.exe
1664	Unicorn-6529.exe
1776	Unicorn-29664.exe
1760	Unicorn-5714.exe
1992	Unicorn-2564.exe
992	Unicorn-2829.exe
2280	Unicorn-37893.exe
1708	Unicorn-43177.exe
888	Unicorn-21579.exe
2452	Unicorn-3275.exe
2208	Unicorn-21579.exe
2640	Unicorn-45891.exe
2792	Unicorn-19559.exe
2984	Unicorn-8127.exe
2788	Unicorn-15339.exe
2580	Unicorn-19908.exe
2264	Unicorn-43650.exe
2204	Unicorn-59378.exe
2148	Unicorn-32544.exe
2064	Unicorn-24275.exe
428	Unicorn-52964.exe
880	Unicorn-18821.exe
1536	Unicorn-45464.exe
2812	Unicorn-23990.exe
1188	Unicorn-61708.exe
1868	Unicorn-23289.exe
2872	Unicorn-41096.exe
1620	Unicorn-29420.exe
1720	Unicorn-34874.exe
2076	Unicorn-39534.exe
3020	Unicorn-15584.exe
2112	Unicorn-63716.exe
1784	Unicorn-52341.exe
1284	Unicorn-24629.exe
1644	Unicorn-13768.exe
2020	Unicorn-58262.exe
2000	Unicorn-12590.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2456	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	29
PID 760 wrote to memory of 2456	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	29
PID 760 wrote to memory of 2456	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	29
PID 760 wrote to memory of 2456	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	29
PID 2456 wrote to memory of 2624	2456	Unicorn-41791.exe	30
PID 2456 wrote to memory of 2624	2456	Unicorn-41791.exe	30
PID 2456 wrote to memory of 2624	2456	Unicorn-41791.exe	30
PID 2456 wrote to memory of 2624	2456	Unicorn-41791.exe	30
PID 760 wrote to memory of 2736	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	31
PID 760 wrote to memory of 2736	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	31
PID 760 wrote to memory of 2736	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	31
PID 760 wrote to memory of 2736	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	31
PID 2624 wrote to memory of 2892	2624	Unicorn-54967.exe	32
PID 2624 wrote to memory of 2892	2624	Unicorn-54967.exe	32
PID 2624 wrote to memory of 2892	2624	Unicorn-54967.exe	32
PID 2624 wrote to memory of 2892	2624	Unicorn-54967.exe	32
PID 2736 wrote to memory of 2568	2736	Unicorn-57660.exe	33
PID 2736 wrote to memory of 2568	2736	Unicorn-57660.exe	33
PID 2736 wrote to memory of 2568	2736	Unicorn-57660.exe	33
PID 2736 wrote to memory of 2568	2736	Unicorn-57660.exe	33
PID 760 wrote to memory of 1684	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	34
PID 760 wrote to memory of 1684	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	34
PID 760 wrote to memory of 1684	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	34
PID 760 wrote to memory of 1684	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	34
PID 2456 wrote to memory of 808	2456	Unicorn-41791.exe	35
PID 2456 wrote to memory of 808	2456	Unicorn-41791.exe	35
PID 2456 wrote to memory of 808	2456	Unicorn-41791.exe	35
PID 2456 wrote to memory of 808	2456	Unicorn-41791.exe	35
PID 2568 wrote to memory of 2584	2568	Unicorn-395.exe	36
PID 2568 wrote to memory of 2584	2568	Unicorn-395.exe	36
PID 2568 wrote to memory of 2584	2568	Unicorn-395.exe	36
PID 2568 wrote to memory of 2584	2568	Unicorn-395.exe	36
PID 2736 wrote to memory of 1496	2736	Unicorn-57660.exe	37
PID 2736 wrote to memory of 1496	2736	Unicorn-57660.exe	37
PID 2736 wrote to memory of 1496	2736	Unicorn-57660.exe	37
PID 2736 wrote to memory of 1496	2736	Unicorn-57660.exe	37
PID 808 wrote to memory of 1816	808	Unicorn-27592.exe	38
PID 808 wrote to memory of 1816	808	Unicorn-27592.exe	38
PID 808 wrote to memory of 1816	808	Unicorn-27592.exe	38
PID 808 wrote to memory of 1816	808	Unicorn-27592.exe	38
PID 2456 wrote to memory of 2424	2456	Unicorn-41791.exe	39
PID 2456 wrote to memory of 2424	2456	Unicorn-41791.exe	39
PID 2456 wrote to memory of 2424	2456	Unicorn-41791.exe	39
PID 2456 wrote to memory of 2424	2456	Unicorn-41791.exe	39
PID 2892 wrote to memory of 2416	2892	Unicorn-16924.exe	40
PID 2892 wrote to memory of 2416	2892	Unicorn-16924.exe	40
PID 2892 wrote to memory of 2416	2892	Unicorn-16924.exe	40
PID 2892 wrote to memory of 2416	2892	Unicorn-16924.exe	40
PID 760 wrote to memory of 2832	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	41
PID 760 wrote to memory of 2832	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	41
PID 760 wrote to memory of 2832	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	41
PID 760 wrote to memory of 2832	760	4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe	41
PID 2624 wrote to memory of 1480	2624	Unicorn-54967.exe	42
PID 2624 wrote to memory of 1480	2624	Unicorn-54967.exe	42
PID 2624 wrote to memory of 1480	2624	Unicorn-54967.exe	42
PID 2624 wrote to memory of 1480	2624	Unicorn-54967.exe	42
PID 2584 wrote to memory of 1036	2584	Unicorn-24983.exe	43
PID 2584 wrote to memory of 1036	2584	Unicorn-24983.exe	43
PID 2584 wrote to memory of 1036	2584	Unicorn-24983.exe	43
PID 2584 wrote to memory of 1036	2584	Unicorn-24983.exe	43
PID 2568 wrote to memory of 972	2568	Unicorn-395.exe	44
PID 2568 wrote to memory of 972	2568	Unicorn-395.exe	44
PID 2568 wrote to memory of 972	2568	Unicorn-395.exe	44
PID 2568 wrote to memory of 972	2568	Unicorn-395.exe	44

C:\Users\Admin\AppData\Local\Temp\4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe
"C:\Users\Admin\AppData\Local\Temp\4a028af865a7884edf619f44d1881c40ee09320174a091ca6544c90a1dc62fe1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        8⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12505.exe
        9⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30543.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60366.exe
        9⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        9⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        8⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30300.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        8⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57748.exe
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        7⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        7⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8127.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18851.exe
        7⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
        7⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46746.exe
        6⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48683.exe
        7⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40127.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        7⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8790.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22330.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
        7⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        7⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60932.exe
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        7⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2943.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23842.exe
        6⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        6⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        6⤵
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35816.exe
        5⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49481.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        5⤵
        
        PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34874.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28820.exe
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51893.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61175.exe
        6⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        6⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
        5⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        5⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13625.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
        5⤵
        
        PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40838.exe
        6⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44469.exe
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47475.exe
        5⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        5⤵
        
        PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        5⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28825.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26255.exe
        5⤵
        
        PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        5⤵
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        5⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        5⤵
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35277.exe
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15216.exe
        5⤵
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40641.exe
        5⤵
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        5⤵
        
        PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8947.exe
        5⤵
        
        PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
      4⤵
      PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
      4⤵
      PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65202.exe
      4⤵
      PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56093.exe
      4⤵
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        6⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45334.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5209.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
        7⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
        6⤵
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        5⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        5⤵
        
        PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51874.exe
        5⤵
        
        PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6794.exe
        5⤵
        
        PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5714.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        
        PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54377.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        5⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        5⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7313.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
      4⤵
      PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
      4⤵
      PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13635.exe
      4⤵
      PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38567.exe
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
        6⤵
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        5⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        5⤵
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        5⤵
        
        PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
        5⤵
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        5⤵
        
        PID:2380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 216
        5⤵
        Program crash
        
        PID:892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41951.exe
      4⤵
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
      4⤵
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5265.exe
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
      4⤵
      PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47105.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
        5⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33285.exe
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30583.exe
      4⤵
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
      4⤵
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13933.exe
      4⤵
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
      4⤵
      PID:5116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32132.exe
      4⤵
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10398.exe
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
      4⤵
      PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      4⤵
      PID:4752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
    3⤵
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
      4⤵
      PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8628.exe
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20412.exe
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
      4⤵
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11930.exe
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
      4⤵
      PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
    3⤵
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56813.exe
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17620.exe
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
    3⤵
    PID:4400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24983.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39534.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42125.exe
        7⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23708.exe
        7⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63327.exe
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
        7⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        6⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        6⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52340.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40286.exe
        6⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
        6⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13768.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5328.exe
        7⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54206.exe
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11302.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57193.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        7⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        6⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60455.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        6⤵
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        6⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        5⤵
        Executes dropped EXE
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54156.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        5⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        5⤵
        
        PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        5⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        5⤵
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12590.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51000.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22363.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7803.exe
        6⤵
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        6⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7860.exe
        5⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56751.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4990.exe
        5⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        5⤵
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63649.exe
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        5⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        5⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        5⤵
        
        PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        5⤵
        
        PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
      4⤵
      PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27783.exe
      4⤵
      PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45190.exe
      4⤵
      PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
      4⤵
      PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43177.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        6⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46261.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23886.exe
        5⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        6⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24881.exe
        6⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29036.exe
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
        6⤵
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        5⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        5⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        5⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6677.exe
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
        6⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51322.exe
        6⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43228.exe
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        5⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        5⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41241.exe
        5⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32923.exe
        5⤵
        
        PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        5⤵
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55140.exe
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        5⤵
        
        PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43758.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18075.exe
      4⤵
      PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18142.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
      4⤵
      PID:4360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
        5⤵
        
        PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9445.exe
      4⤵
      PID:696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
      4⤵
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
      4⤵
      PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
      4⤵
      PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39466.exe
      4⤵
      PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2564.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32292.exe
        5⤵
        
        PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53797.exe
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33100.exe
      4⤵
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6419.exe
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62214.exe
      4⤵
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49592.exe
    3⤵
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27280.exe
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2997.exe
      4⤵
      PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
      4⤵
      PID:4724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
    3⤵
    PID:3784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
    3⤵
    PID:4668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59378.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
      4⤵
      PID:632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      4⤵
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24753.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41913.exe
      4⤵
      PID:3588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20405.exe
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
    3⤵
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36461.exe
    3⤵
    PID:1588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
      4⤵
      PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
    3⤵
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
    3⤵
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
    3⤵
    PID:4208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
      4⤵
      PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16733.exe
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62797.exe
      4⤵
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17612.exe
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
    3⤵
    PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12460.exe
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
    3⤵
    PID:5104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7404.exe
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29308.exe
    3⤵
    PID:4372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60.exe
    3⤵
    PID:4944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57771.exe
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
  2⤵
  PID:3096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8025.exe
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
  2⤵
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe

Filesize
468KB

MD5
c40b5dbd0d12eeb9571f65da3d4e622c

SHA1
269a0fa2fbb56a5512bc71c2186cc11618579821

SHA256
122acafc16cc3f7cc5ecbd8a4d726fa3c44980e0b579f16544a02caee0850bc3

SHA512
3d6c60f19df6c5d1f6b4d911ec9faacc4af324bdae804533a960e4a026dfceace7966c885d969af196e4753f080f7bb11d4aef578a864657b49a0303c151357b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe

Filesize
468KB

MD5
7c37afc73f4e4216e4ce295909ed745c

SHA1
12a9b8359378d8481d515d61f1b42acbddcdd659

SHA256
26a05f6ed735d86bd9786c3ba018cdbc6abd5580bf4d18745c595e0c76039d08

SHA512
3c62df478d582dfd96ca9941d3b087811bfc8f473562895ac0d3eac1746256544b3815bea482db08a84fed282821e260725cdb541332ff8e35203707e3bdc3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe

Filesize
468KB

MD5
a04321676900d3c6ec584a23f268968b

SHA1
cf663209e4790322d3cc586304d9f70f07ce3320

SHA256
6c895c2559525ca42b74f1b51b1918720c75424d894342e9ab48cc3ac40d73ae

SHA512
30a777916719f956b8511584540a52645b88671e40a3e721f2e4f0bcc1e198b4f6351d9b1273b8dfd5e2685aa8e6d507fe52fe1f2c3fa95d50a895f025549ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe

Filesize
468KB

MD5
9425dfbfbb15d3a3c84fe286bede8afd

SHA1
52a0fb67e78e36ce8556b22fcdc61faa451a3312

SHA256
d142cd877c2ce06650c1b18f3d5390f56d898716480b1e3d91e0d69d897f26f8

SHA512
f5219d0246c30ca3fccbae58fce219cf4609278f622328c47d192a8f91c530374b3853a9b8a534cbd9eb9e765786b9e5076f39ec48bcb1b9c4d1757d0d781ab3

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe

Filesize
468KB

MD5
f163d068224b7456ec552663cd5dad76

SHA1
4805afaa91073610b9c7e1c9014e5a4c53c7362a

SHA256
25affd499e1aa0e40fd2c06082fe35ee6ae2492124e388ab483de1808ddf4eaf

SHA512
9ae4244cb1f4a575fd093a37b10dfacb847cac1169acf7ade2f7b65458c3d0a4bb0e3cb297f3aa81d828ac53ed8f6ff7d081e65bf2d29f13f71fc9a28b6fc9fc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe

Filesize
468KB

MD5
aeb294287c2b789421950f1d44ba4ef8

SHA1
cc41278333719daf475ca605abfe33eca823e8d0

SHA256
da779ddd36b395a4d077a753758e708bfaa1fe00ab69c7537d85c8d521d68201

SHA512
7160dc5f0e546783451a908609ed0787574ae7059a33ff2596a607f8b32c94af94d6db952c7b87e55d675e8383bfccef865392994496cf10667ae6de5441b410

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe

Filesize
468KB

MD5
624b77a4871c95ba736e13d5a2cbbce5

SHA1
f56360c13080a0619549e072daaee4bef0fdec7b

SHA256
c14a0319b50ce084c7cf47ebb45dba2d69d5098e5a51364e348f4eb7241d228a

SHA512
1309f541291c48d8c188e1df6163a067b138e4d4b5a415d746d65446f99ffd87d8b697ff06c5a26999f1bdbb1751f6cfe2f7406a7bc498e6b84e7f7680e39614

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-24983.exe

Filesize
468KB

MD5
a4f2b60f01b388d07a4fd3a3edabab4e

SHA1
825a930cc9d48e9c703bf7e51f185ce8a34738ce

SHA256
8d48f2471f97e7f8e10dda33bade66c34a613cac7e1a28e9dca47959bae9b6b8

SHA512
4c276afe75cf96b7bb475acfecbf5b7e30a9937689fabe08e3fb8a0988ba3fc88871e0a9fa6167e7b7b975e9cd68795c033a18027d136c14b78afb141b2b75f2

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41791.exe

Filesize
468KB

MD5
3cb792060d2543c63842e0ed23a55d65

SHA1
89d61e6fb9f6a3d38f3901015c1538a5017575f7

SHA256
bb9efea96f2f2074ca77112faf0a8a2cf27a8392c6a294c17772919f4dc834c7

SHA512
d22d8d5e9675db9182791c0c0680cd2b5a80ee6db5b5d255b76d8b331e12717be30488c66ed779605856e31c59247e9f499ec6550646b2672fd45aec7ceaeefa

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe

Filesize
468KB

MD5
77a2775ac859c35501e74c50218e3d03

SHA1
ce00c6d6eb13df40a98cdd12147278cb1aef63f9

SHA256
f69fb581618b7b4f0cf6d4c18f2bb0948668e10e9005fb0f946477aaee12b932

SHA512
77ce6aba3f205810547935def98f95e3070ee78075d9079a718cee0e712162a794de67f028bfd6d397bc9beee4dad3e8e1fc1a3572cbafeaac807439520d0c0c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-41895.exe

Filesize
468KB

MD5
de1bf88c7e04c826a8938d1bccfd7553

SHA1
248398b24eb76119b8948706a26c46d39f91835c

SHA256
f9bb88226d62ac23a0cf984f94d6acbe021dbb0de8dcd4cb6a8c199f796240b0

SHA512
5b4cf3ff9a0171e175e38ff5acf205f692c21d969d2be1c8ba4798bd38035c2e002c0f0f80c71e6c74bd3e2602cfb03e8d9fec746d2f22a8e616751f3a62e606

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47110.exe

Filesize
468KB

MD5
ecd1195557106162b5c3196378adbd1a

SHA1
49d6f40867420d47a0ae5feec8ada834a6175ce0

SHA256
c6c46ac1fad2e02046b639c367ab98bb9dc8536a11e9c12a5ee50bab322c568a

SHA512
a0568e611bf06d937a10e2746135fca88dca6c1e00c128b9bfc133927e35a98403d875f10e07532f91e787c428ca75af40b8f9aaa694192b8d92084451f93ab6

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe

Filesize
468KB

MD5
83e4d901883927746e70e86338147781

SHA1
4b1b0092d24b50631647941ffbeca5163e118bdd

SHA256
123a585281d21a2011607051d40b605fe98c149574564dd96d6ee18cfd363fb1

SHA512
68efc0a66a9b209f0ac84fdf2461f7e0be39a0e9a9945549920b7b05fcc8228e0a806beb5fe405395381a9bb7949c02189417812274ced14614ec28f729f74cc

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe

Filesize
468KB

MD5
543ff199aa48ade70d4ca06f2d9252f8

SHA1
aae93a427454e84cbfdb04a85e5011ed7e579d78

SHA256
d683e18531ec01ea81684b919a0e415bda4705c206d0bd095a71287f11529741

SHA512
ae86c994c67c55235a15d544419efdb5f78e3f61840ae8c0a9f47e50fc29e08bc5d6290c857eee2304f28e52fc613045cb29cff609c4491aef58b78199d56249

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe

Filesize
468KB

MD5
e2455889d8691b7816a392f615e4da59

SHA1
13abb12359fa125c5f5c938e8cf15547894b557c

SHA256
62995a3c763e2df0b728ba33d7f548bc05b206986a9ba7d287f5aa58e2f2e644

SHA512
7a3da83938af8a4e04d9f598d390b58358b91b306f09540a795a19fdaf4d3c7ad321a936ee3caa2e98ba7612f5d10a44e92dcd2abab8ce551bb773170cff13da

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55718.exe

Filesize
468KB

MD5
beed7e5730383c1103e037d813129f55

SHA1
738375c3a80ec60121b877b2c7809a99fd30c6c5

SHA256
1f564c933cc1dd4fc50d222f119a03de145f9045ec2bc08e9ec31bdec1db33c3

SHA512
5965bc89442df4582d58c1af580be96d055a18b9ef44aeeaa9f0edfced6c78c377a0b3798e2721aa5ad60e80f52c03e04b5c217a54ef0dfaccdaa5615f80fb5e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe

Filesize
468KB

MD5
b91a0a7fdb39f1b2f1590657698e91ef

SHA1
93d989ad4f823173f225934ab5ee4d6ce2df536c

SHA256
2d07ec00b96644ba628b9a71440057138bc7cb3c843c6642ca73c88b83ba0102

SHA512
a5303b66d8a0c5e2eb0342c07f8d4a5cec0622be0ab7bf191ac017f24cd5f4b2fc3ca127b8267a70c94f6b0cd8872a45a6c615fad8fac0c756e243c24c5cb09c

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe

Filesize
468KB

MD5
8b2c2d6fbe613d380af108916b23748e

SHA1
5d1b7b3899eccae2e203acc23e111fda19e185c8

SHA256
3dec88bf718dff2840d404824fce0248d5c3ed8d2fa1737e9226d3d170991922

SHA512
791b6d3306d8ccf7af8d8df5d5f7da8d0ead826e85dd8fcc1626b576fce2b4409d9179196626e8236444b0fa26e422e0920262d2af403cab4e701a3c09a017c1

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe

Filesize
468KB

MD5
57d9e0b7be3218745a07648d1f2031c4

SHA1
76963dadeb722ef7af0571d909968e71853810b3

SHA256
ca82eae94ab254692214cd0d7df0d5e38be33591bf732e9add391c32e03717b4

SHA512
f320333042116100202ac42a5df54862d032d31a5f8360874fb2db67d185655d9e954060e76f3aee7162325b36d54a9f98038503327c77b1441054e78ac9138f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads