89e12a92d27deffeada5d19b11fcf19a78affcff8112734a9205dcbf4ac3102e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe
Size

184KB
MD5

66085f9d3ceddf0f57f21d1488733060
SHA1

79dc9142d92271253f4b94ef90d3033d12198396
SHA256

89e12a92d27deffeada5d19b11fcf19a78affcff8112734a9205dcbf4ac3102e
SHA512

dfc211793e483f8e41f7d6c296b9e40a445007bcfc1e4275656efeb0b646e31af0812db39b3b8696b130215c7bf3a55faf473bd02fa66b91f8cb5a1466724042
SSDEEP

3072:qSYfiURnRcJezl2tWIr8b2zo6vNqnviug:qSmRI0l2J8yzo6Vqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

Processes:

Unicorn-33156.exeUnicorn-38401.exeUnicorn-34020.exeUnicorn-646.exeUnicorn-46348.exeUnicorn-32612.exeUnicorn-26282.exeUnicorn-5123.exeUnicorn-54443.exeUnicorn-43774.exeUnicorn-27521.exeUnicorn-38220.exeUnicorn-44085.exeUnicorn-34372.exeUnicorn-46991.exeUnicorn-765.exeUnicorn-12394.exeUnicorn-30724.exeUnicorn-48722.exeUnicorn-54852.exeUnicorn-53736.exeUnicorn-55812.exeUnicorn-5568.exeUnicorn-22782.exeUnicorn-13851.exeUnicorn-36798.exeUnicorn-52200.exeUnicorn-51137.exeUnicorn-13482.exeUnicorn-17095.exeUnicorn-3124.exeUnicorn-52990.exeUnicorn-16452.exeUnicorn-62123.exeUnicorn-50508.exeUnicorn-11843.exeUnicorn-8231.exeUnicorn-57217.exeUnicorn-19837.exeUnicorn-11581.exeUnicorn-42500.exeUnicorn-23175.exeUnicorn-63822.exeUnicorn-49823.exeUnicorn-58753.exeUnicorn-38887.exeUnicorn-15494.exeUnicorn-32324.exeUnicorn-26193.exeUnicorn-47461.exeUnicorn-58753.exeUnicorn-44943.exeUnicorn-31207.exeUnicorn-31207.exeUnicorn-18500.exeUnicorn-17383.exeUnicorn-41857.exeUnicorn-58686.exeUnicorn-6854.exeUnicorn-30430.exeUnicorn-50414.exeUnicorn-64149.exeUnicorn-61639.exeUnicorn-58987.exe

pid	process
1492	Unicorn-33156.exe
2588	Unicorn-38401.exe
780	Unicorn-34020.exe
2172	Unicorn-646.exe
1520	Unicorn-46348.exe
1428	Unicorn-32612.exe
4524	Unicorn-26282.exe
4312	Unicorn-5123.exe
4176	Unicorn-54443.exe
4656	Unicorn-43774.exe
1744	Unicorn-27521.exe
2016	Unicorn-38220.exe
1992	Unicorn-44085.exe
2936	Unicorn-34372.exe
4396	Unicorn-46991.exe
3472	Unicorn-765.exe
3572	Unicorn-12394.exe
1612	Unicorn-30724.exe
1488	Unicorn-48722.exe
1072	Unicorn-54852.exe
4044	Unicorn-53736.exe
4912	Unicorn-55812.exe
4228	Unicorn-5568.exe
1396	Unicorn-22782.exe
1712	Unicorn-13851.exe
2740	Unicorn-36798.exe
1452	Unicorn-52200.exe
1576	Unicorn-51137.exe
1652	Unicorn-13482.exe
3408	Unicorn-17095.exe
4064	Unicorn-3124.exe
2848	Unicorn-52990.exe
2204	Unicorn-16452.exe
4020	Unicorn-62123.exe
3424	Unicorn-50508.exe
4572	Unicorn-11843.exe
2836	Unicorn-8231.exe
1668	Unicorn-57217.exe
680	Unicorn-19837.exe
408	Unicorn-11581.exe
3596	Unicorn-42500.exe
2420	Unicorn-23175.exe
4624	Unicorn-63822.exe
392	Unicorn-49823.exe
2808	Unicorn-58753.exe
4964	Unicorn-38887.exe
2796	Unicorn-15494.exe
744	Unicorn-32324.exe
4788	Unicorn-26193.exe
5056	Unicorn-47461.exe
2348	Unicorn-58753.exe
1404	Unicorn-44943.exe
3484	Unicorn-31207.exe
4060	Unicorn-31207.exe
3668	Unicorn-18500.exe
1540	Unicorn-17383.exe
3444	Unicorn-41857.exe
4160	Unicorn-58686.exe
4412	Unicorn-6854.exe
1780	Unicorn-30430.exe
216	Unicorn-50414.exe
2956	Unicorn-64149.exe
4792	Unicorn-61639.exe
640	Unicorn-58987.exe

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
18220	16668	WerFault.exe	Unicorn-26920.exe
18400	5080	WerFault.exe	Unicorn-20539.exe
6664	17416	WerFault.exe	Unicorn-38918.exe
1572	17424	WerFault.exe	Unicorn-38918.exe
7836	6412		Unicorn-41747.exe
12416	4656		Unicorn-43774.exe
12756	7460		Unicorn-36830.exe
11304	7856
14964	7416		Unicorn-53896.exe
12704	9052
14668	6752		Unicorn-58500.exe
6672	5836		Unicorn-26858.exe
16224	6168		Unicorn-58252.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

OfficeClickToRun.exeOfficeClickToRun.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

dwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	7340	dwm.exe
Token: SeChangeNotifyPrivilege	7340	dwm.exe
Token: 33	7340	dwm.exe
Token: SeIncBasePriorityPrivilege	7340	dwm.exe
Token: SeCreateGlobalPrivilege	11748
Token: SeChangeNotifyPrivilege	11748
Token: 33	11748
Token: SeIncBasePriorityPrivilege	11748

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exeUnicorn-33156.exeUnicorn-38401.exeUnicorn-34020.exeUnicorn-646.exeUnicorn-46348.exeUnicorn-32612.exeUnicorn-26282.exeUnicorn-5123.exeUnicorn-54443.exeUnicorn-43774.exeUnicorn-38220.exeUnicorn-27521.exeUnicorn-44085.exeUnicorn-34372.exeUnicorn-46991.exeUnicorn-765.exeUnicorn-12394.exeUnicorn-30724.exeUnicorn-48722.exeUnicorn-54852.exeUnicorn-55812.exeUnicorn-36798.exeUnicorn-13851.exeUnicorn-53736.exeUnicorn-5568.exeUnicorn-22782.exeUnicorn-52200.exeUnicorn-51137.exeUnicorn-13482.exeUnicorn-17095.exeUnicorn-3124.exeUnicorn-52990.exeUnicorn-16452.exeUnicorn-62123.exeUnicorn-50508.exeUnicorn-11843.exeUnicorn-8231.exeUnicorn-57217.exeUnicorn-19837.exeUnicorn-11581.exeUnicorn-42500.exeUnicorn-23175.exeUnicorn-63822.exeUnicorn-26193.exeUnicorn-49823.exeUnicorn-15494.exeUnicorn-38887.exeUnicorn-47461.exeUnicorn-31207.exeUnicorn-32324.exeUnicorn-31207.exeUnicorn-44943.exeUnicorn-58753.exeUnicorn-58753.exeUnicorn-18500.exeUnicorn-17383.exeUnicorn-6854.exeUnicorn-58686.exeUnicorn-50414.exeUnicorn-41857.exeUnicorn-64149.exeUnicorn-30430.exeUnicorn-58987.exe

pid	process
1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe
1492	Unicorn-33156.exe
2588	Unicorn-38401.exe
780	Unicorn-34020.exe
2172	Unicorn-646.exe
1520	Unicorn-46348.exe
1428	Unicorn-32612.exe
4524	Unicorn-26282.exe
4312	Unicorn-5123.exe
4176	Unicorn-54443.exe
4656	Unicorn-43774.exe
2016	Unicorn-38220.exe
1744	Unicorn-27521.exe
1992	Unicorn-44085.exe
2936	Unicorn-34372.exe
4396	Unicorn-46991.exe
3472	Unicorn-765.exe
3572	Unicorn-12394.exe
1612	Unicorn-30724.exe
1488	Unicorn-48722.exe
1072	Unicorn-54852.exe
4912	Unicorn-55812.exe
2740	Unicorn-36798.exe
1712	Unicorn-13851.exe
4044	Unicorn-53736.exe
4228	Unicorn-5568.exe
1396	Unicorn-22782.exe
1452	Unicorn-52200.exe
1576	Unicorn-51137.exe
1652	Unicorn-13482.exe
3408	Unicorn-17095.exe
4064	Unicorn-3124.exe
2848	Unicorn-52990.exe
2204	Unicorn-16452.exe
4020	Unicorn-62123.exe
3424	Unicorn-50508.exe
4572	Unicorn-11843.exe
2836	Unicorn-8231.exe
1668	Unicorn-57217.exe
680	Unicorn-19837.exe
408	Unicorn-11581.exe
3596	Unicorn-42500.exe
2420	Unicorn-23175.exe
4624	Unicorn-63822.exe
4788	Unicorn-26193.exe
392	Unicorn-49823.exe
2796	Unicorn-15494.exe
4964	Unicorn-38887.exe
5056	Unicorn-47461.exe
3484	Unicorn-31207.exe
744	Unicorn-32324.exe
4060	Unicorn-31207.exe
1404	Unicorn-44943.exe
2808	Unicorn-58753.exe
2348	Unicorn-58753.exe
3668	Unicorn-18500.exe
1540	Unicorn-17383.exe
4412	Unicorn-6854.exe
4160	Unicorn-58686.exe
216	Unicorn-50414.exe
3444	Unicorn-41857.exe
2956	Unicorn-64149.exe
1780	Unicorn-30430.exe
640	Unicorn-58987.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exeUnicorn-33156.exeUnicorn-34020.exeUnicorn-38401.exeUnicorn-646.exeUnicorn-46348.exeUnicorn-32612.exeUnicorn-26282.exeUnicorn-5123.exeUnicorn-54443.exeUnicorn-43774.exeUnicorn-44085.exe

description	pid	process	target process
PID 1216 wrote to memory of 1492	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-33156.exe
PID 1216 wrote to memory of 1492	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-33156.exe
PID 1216 wrote to memory of 1492	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-33156.exe
PID 1492 wrote to memory of 2588	1492	Unicorn-33156.exe	Unicorn-38401.exe
PID 1492 wrote to memory of 2588	1492	Unicorn-33156.exe	Unicorn-38401.exe
PID 1492 wrote to memory of 2588	1492	Unicorn-33156.exe	Unicorn-38401.exe
PID 1216 wrote to memory of 780	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-34020.exe
PID 1216 wrote to memory of 780	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-34020.exe
PID 1216 wrote to memory of 780	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-34020.exe
PID 780 wrote to memory of 2172	780	Unicorn-34020.exe	Unicorn-646.exe
PID 780 wrote to memory of 2172	780	Unicorn-34020.exe	Unicorn-646.exe
PID 780 wrote to memory of 2172	780	Unicorn-34020.exe	Unicorn-646.exe
PID 1492 wrote to memory of 1428	1492	Unicorn-33156.exe	Unicorn-32612.exe
PID 1492 wrote to memory of 1428	1492	Unicorn-33156.exe	Unicorn-32612.exe
PID 1492 wrote to memory of 1428	1492	Unicorn-33156.exe	Unicorn-32612.exe
PID 1216 wrote to memory of 1520	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-46348.exe
PID 1216 wrote to memory of 1520	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-46348.exe
PID 1216 wrote to memory of 1520	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-46348.exe
PID 2588 wrote to memory of 4524	2588	Unicorn-38401.exe	Unicorn-26282.exe
PID 2588 wrote to memory of 4524	2588	Unicorn-38401.exe	Unicorn-26282.exe
PID 2588 wrote to memory of 4524	2588	Unicorn-38401.exe	Unicorn-26282.exe
PID 2172 wrote to memory of 4312	2172	Unicorn-646.exe	Unicorn-5123.exe
PID 2172 wrote to memory of 4312	2172	Unicorn-646.exe	Unicorn-5123.exe
PID 2172 wrote to memory of 4312	2172	Unicorn-646.exe	Unicorn-5123.exe
PID 780 wrote to memory of 4176	780	Unicorn-34020.exe	Unicorn-54443.exe
PID 780 wrote to memory of 4176	780	Unicorn-34020.exe	Unicorn-54443.exe
PID 780 wrote to memory of 4176	780	Unicorn-34020.exe	Unicorn-54443.exe
PID 1520 wrote to memory of 4656	1520	Unicorn-46348.exe	Unicorn-43774.exe
PID 1520 wrote to memory of 4656	1520	Unicorn-46348.exe	Unicorn-43774.exe
PID 1520 wrote to memory of 4656	1520	Unicorn-46348.exe	Unicorn-43774.exe
PID 1428 wrote to memory of 1744	1428	Unicorn-32612.exe	Unicorn-27521.exe
PID 1428 wrote to memory of 1744	1428	Unicorn-32612.exe	Unicorn-27521.exe
PID 1428 wrote to memory of 1744	1428	Unicorn-32612.exe	Unicorn-27521.exe
PID 1492 wrote to memory of 2016	1492	Unicorn-33156.exe	Unicorn-38220.exe
PID 1492 wrote to memory of 2016	1492	Unicorn-33156.exe	Unicorn-38220.exe
PID 1492 wrote to memory of 2016	1492	Unicorn-33156.exe	Unicorn-38220.exe
PID 1216 wrote to memory of 1992	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-44085.exe
PID 1216 wrote to memory of 1992	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-44085.exe
PID 1216 wrote to memory of 1992	1216	66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe	Unicorn-44085.exe
PID 4524 wrote to memory of 2936	4524	Unicorn-26282.exe	Unicorn-34372.exe
PID 4524 wrote to memory of 2936	4524	Unicorn-26282.exe	Unicorn-34372.exe
PID 4524 wrote to memory of 2936	4524	Unicorn-26282.exe	Unicorn-34372.exe
PID 2588 wrote to memory of 4396	2588	Unicorn-38401.exe	Unicorn-46991.exe
PID 2588 wrote to memory of 4396	2588	Unicorn-38401.exe	Unicorn-46991.exe
PID 2588 wrote to memory of 4396	2588	Unicorn-38401.exe	Unicorn-46991.exe
PID 4312 wrote to memory of 3472	4312	Unicorn-5123.exe	Unicorn-765.exe
PID 4312 wrote to memory of 3472	4312	Unicorn-5123.exe	Unicorn-765.exe
PID 4312 wrote to memory of 3472	4312	Unicorn-5123.exe	Unicorn-765.exe
PID 2172 wrote to memory of 3572	2172	Unicorn-646.exe	Unicorn-12394.exe
PID 2172 wrote to memory of 3572	2172	Unicorn-646.exe	Unicorn-12394.exe
PID 2172 wrote to memory of 3572	2172	Unicorn-646.exe	Unicorn-12394.exe
PID 4176 wrote to memory of 1612	4176	Unicorn-54443.exe	Unicorn-30724.exe
PID 4176 wrote to memory of 1612	4176	Unicorn-54443.exe	Unicorn-30724.exe
PID 4176 wrote to memory of 1612	4176	Unicorn-54443.exe	Unicorn-30724.exe
PID 780 wrote to memory of 1488	780	Unicorn-34020.exe	Unicorn-48722.exe
PID 780 wrote to memory of 1488	780	Unicorn-34020.exe	Unicorn-48722.exe
PID 780 wrote to memory of 1488	780	Unicorn-34020.exe	Unicorn-48722.exe
PID 4656 wrote to memory of 1072	4656	Unicorn-43774.exe	Unicorn-54852.exe
PID 4656 wrote to memory of 1072	4656	Unicorn-43774.exe	Unicorn-54852.exe
PID 4656 wrote to memory of 1072	4656	Unicorn-43774.exe	Unicorn-54852.exe
PID 1992 wrote to memory of 4912	1992	Unicorn-44085.exe	Unicorn-55812.exe
PID 1992 wrote to memory of 4912	1992	Unicorn-44085.exe	Unicorn-55812.exe
PID 1992 wrote to memory of 4912	1992	Unicorn-44085.exe	Unicorn-55812.exe
PID 1520 wrote to memory of 4044	1520	Unicorn-46348.exe	Unicorn-53736.exe

C:\Users\Admin\AppData\Local\Temp\66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\66085f9d3ceddf0f57f21d1488733060_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588

C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524

C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576

C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18500.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45188.exe
8⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
9⤵
PID:7740

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
9⤵
PID:10524

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
9⤵
PID:14492

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
9⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
8⤵
PID:8000

C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
8⤵
PID:11700

C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
8⤵
PID:15652

C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
8⤵
PID:18412

C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
8⤵
PID:18040

C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61477.exe
7⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
8⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
8⤵
PID:10332

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
8⤵
PID:14504

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
8⤵
PID:17580

C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
7⤵
PID:5952

C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22444.exe
7⤵
PID:10568

C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
7⤵
PID:14528

C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
7⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17383.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540

C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
7⤵
PID:5908

C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
8⤵
PID:6884

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
8⤵
PID:9608

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
8⤵
PID:1448

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
8⤵
PID:15328

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
8⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
7⤵
PID:7224

C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
8⤵
PID:13868

C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
8⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
8⤵
PID:5652

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
7⤵
PID:9988

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
7⤵
PID:13516

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
7⤵
PID:16508

C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16888.exe
7⤵
PID:5712

C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
7⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
7⤵
PID:6656

C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14283.exe
6⤵
PID:5212

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
7⤵
PID:7540

C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
7⤵
PID:10224

C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
7⤵
PID:14752

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
6⤵
PID:7892

C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
6⤵
PID:11344

C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50050.exe
6⤵
PID:14924

C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
6⤵
PID:17460

C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1652

C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4160

C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
7⤵
PID:6532

C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
8⤵
PID:10008

C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11742.exe
8⤵
PID:14064

C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
8⤵
PID:1856

C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
8⤵
PID:17504

C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58118.exe
7⤵
PID:8552

C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
7⤵
PID:12648

C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35791.exe
7⤵
PID:15908

C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
7⤵
PID:18172

C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41555.exe
7⤵
PID:5004

C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
6⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
7⤵
PID:8028

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
7⤵
PID:10488

C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
7⤵
PID:14340

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
7⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
6⤵
PID:7936

C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
6⤵
PID:10656

C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40275.exe
6⤵
PID:14448

C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41281.exe
6⤵
PID:2404

C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3076.exe
6⤵
PID:16912

C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2956

C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
6⤵
PID:6040

C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
7⤵
PID:7532

C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
8⤵
PID:16528

C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
8⤵
PID:16524

C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
7⤵
PID:10548

C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
7⤵
PID:14184

C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
7⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
7⤵
PID:18316

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
7⤵
PID:16772

C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14695.exe
6⤵
PID:8080

C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
6⤵
PID:10572

C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
6⤵
PID:14152

C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
6⤵
PID:16440

C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
5⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
6⤵
PID:7824

C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
6⤵
PID:10016

C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
6⤵
PID:14712

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
6⤵
PID:17496

C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
6⤵
PID:1664

C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52889.exe
5⤵
PID:8196

C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
5⤵
PID:12208

C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
5⤵
PID:15332

C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
5⤵
PID:17644

C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3408

C:\Users\Admin\AppData\Local\Temp\Unicorn-41857.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41857.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
7⤵
PID:5724

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
8⤵
PID:7580

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
8⤵
PID:10624

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
8⤵
PID:14520

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
8⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
8⤵
PID:17496

C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58783.exe
7⤵
PID:8020

C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37443.exe
7⤵
PID:11828

C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
7⤵
PID:15184

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
7⤵
PID:5372

C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
6⤵
PID:5836

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
7⤵
PID:7708

C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22168.exe
7⤵
PID:11252

C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
7⤵
PID:14720

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
6⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62825.exe
6⤵
PID:12100

C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
6⤵
PID:15060

C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30267.exe
6⤵
PID:18012

C:\Users\Admin\AppData\Local\Temp\Unicorn-50414.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50414.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:216

C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
6⤵
PID:5964

C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
7⤵
PID:6704

C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
7⤵
PID:9832

C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
7⤵
PID:13412

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
7⤵
PID:16620

C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
7⤵
PID:6252

C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
6⤵
PID:5756

C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
7⤵
PID:5804

C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
7⤵
PID:6200

C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32069.exe
6⤵
PID:9892

C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
6⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44179.exe
6⤵
PID:16524

C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
6⤵
PID:7688

C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
5⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
6⤵
PID:7548

C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
6⤵
PID:10616

C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
6⤵
PID:14100

C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
6⤵
PID:16796

C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
6⤵
PID:9512

C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
5⤵
PID:7628

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
5⤵
PID:10824

C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16507.exe
5⤵
PID:13840

C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
5⤵
PID:16504

C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4064

C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4412

C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
6⤵
PID:5808

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
7⤵
PID:12096

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
7⤵
PID:16312

C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
7⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27480.exe
7⤵
PID:6492

C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45026.exe
6⤵
PID:8128

C:\Users\Admin\AppData\Local\Temp\Unicorn-38979.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38979.exe
6⤵
PID:12120

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
6⤵
PID:15340

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
6⤵
PID:4124

C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
5⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
6⤵
PID:11588

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
6⤵
PID:16060

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
6⤵
PID:5160

C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
5⤵
PID:6788

C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
5⤵
PID:11308

C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
5⤵
PID:15112

C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
5⤵
PID:17488

C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21101.exe
5⤵
PID:6524

C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
6⤵
PID:10692

C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
6⤵
PID:14588

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
6⤵
PID:17524

C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
5⤵
PID:8652

C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43433.exe
5⤵
PID:12728

C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
5⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3831.exe
5⤵
PID:9544

C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9421.exe
4⤵
PID:5428

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
5⤵
PID:7980

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
5⤵
PID:10340

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
5⤵
PID:14040

C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
5⤵
PID:3092

C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
4⤵
PID:7948

C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
4⤵
PID:11816

C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
4⤵
PID:14800

C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
4⤵
PID:17480

C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428

C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Users\Admin\AppData\Local\Temp\Unicorn-15494.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15494.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
7⤵
PID:5468

C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
8⤵
PID:4928

C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
9⤵
PID:12684

C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
9⤵
PID:15880

C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
9⤵
PID:6256

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
8⤵
PID:9592

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
8⤵
PID:12592

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
8⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
8⤵
PID:18312

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
8⤵
PID:18236

C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
7⤵
PID:8132

C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57196.exe
7⤵
PID:10996

C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
7⤵
PID:14056

C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
7⤵
PID:3548

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
7⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31917.exe
6⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
7⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
8⤵
PID:11640

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
8⤵
PID:15720

C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
8⤵
PID:17668

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
7⤵
PID:9276

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
7⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
7⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
7⤵
PID:5164

C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
6⤵
PID:7320

C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
6⤵
PID:10628

C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35541.exe
6⤵
PID:13524

C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
6⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 464
7⤵
- Program crash
PID:18400

C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
6⤵
PID:9468

C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
6⤵
PID:5608

C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
7⤵
PID:6808

C:\Users\Admin\AppData\Local\Temp\Unicorn-39029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39029.exe
8⤵
PID:10120

C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
8⤵
PID:13860

C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
8⤵
PID:4968

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
7⤵
PID:9640

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
7⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
7⤵
PID:14932

C:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18625.exe
7⤵
PID:18404

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
7⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
6⤵
PID:6996

C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
7⤵
PID:3020

C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46211.exe
6⤵
PID:9960

C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
6⤵
PID:13716

C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
6⤵
PID:16564

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
6⤵
PID:18388

C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
5⤵
PID:5996

C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22023.exe
6⤵
PID:7404

C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
7⤵
PID:11160

C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
7⤵
PID:14744

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
7⤵
PID:5328

C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42584.exe
6⤵
PID:10468

C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25666.exe
6⤵
PID:13948

C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
6⤵
PID:16908

C:\Users\Admin\AppData\Local\Temp\Unicorn-25295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25295.exe
6⤵
PID:18248

C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37368.exe
5⤵
PID:7636

C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
5⤵
PID:10816

C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
5⤵
PID:13296

C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7713.exe
5⤵
PID:3692

C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
5⤵
PID:6776

C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1452

C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24301.exe
5⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
6⤵
PID:6816

C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
7⤵
PID:8700

C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
7⤵
PID:12880

C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37056.exe
7⤵
PID:16040

C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
7⤵
PID:6680

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
7⤵
PID:6424

C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10273.exe
6⤵
PID:8864

C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
6⤵
PID:13300

C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
6⤵
PID:16348

C:\Users\Admin\AppData\Local\Temp\Unicorn-52185.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52185.exe
6⤵
PID:18216

C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
5⤵
PID:7124

C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
5⤵
PID:8116

C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
5⤵
PID:14028

C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
5⤵
PID:16668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16668 -s 452
6⤵
- Program crash
PID:18220

C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
5⤵
PID:7512

C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
5⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
6⤵
PID:2448

C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
7⤵
PID:11424

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
7⤵
PID:15892

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
6⤵
PID:10048

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
6⤵
PID:13544

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
6⤵
PID:16628

C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40702.exe
6⤵
PID:544

C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
6⤵
PID:5672

C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
5⤵
PID:6164

C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52667.exe
6⤵
PID:10148

C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
6⤵
PID:14696

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
6⤵
PID:17468

C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
5⤵
PID:9844

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
5⤵
PID:13508

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
5⤵
PID:16636

C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12848.exe
5⤵
PID:9568

C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
4⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
5⤵
PID:6900

C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57275.exe
6⤵
PID:9232

C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
6⤵
PID:14704

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
6⤵
PID:16488

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
5⤵
PID:9632

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
5⤵
PID:12524

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
5⤵
PID:16388

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
5⤵
PID:18428

C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
4⤵
PID:6176

C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
5⤵
PID:11412

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
5⤵
PID:15736

C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
5⤵
PID:11440

C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21950.exe
4⤵
PID:9876

C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
4⤵
PID:13440

C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
4⤵
PID:16536

C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42459.exe
4⤵
PID:6136

C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:744

C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
6⤵
PID:5496

C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27268.exe
7⤵
PID:6224

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
7⤵
PID:9244

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
7⤵
PID:11420

C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
7⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
7⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
6⤵
PID:6760

C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23858.exe
7⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
7⤵
PID:18116

C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5154.exe
7⤵
PID:17440

C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
6⤵
PID:10228

C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28210.exe
6⤵
PID:13604

C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
6⤵
PID:16716

C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-738.exe
6⤵
PID:4168

C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
5⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
6⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
6⤵
PID:9648

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
6⤵
PID:11560

C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
6⤵
PID:16448

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
6⤵
PID:7064

C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3668.exe
5⤵
PID:6968

C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
5⤵
PID:9868

C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
5⤵
PID:13616

C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17022.exe
5⤵
PID:16708

C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
5⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31303.exe
6⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
7⤵
PID:16020

C:\Users\Admin\AppData\Local\Temp\Unicorn-56034.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56034.exe
7⤵
PID:18336

C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
7⤵
PID:18352

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
6⤵
PID:9656

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
6⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
6⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57238.exe
6⤵
PID:5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
6⤵
PID:18424

C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41956.exe
5⤵
PID:6592

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
5⤵
PID:9952

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
5⤵
PID:13552

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
5⤵
PID:16596

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
5⤵
PID:18212

C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
4⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20597.exe
5⤵
PID:11564

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
5⤵
PID:15704

C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
5⤵
PID:9460

C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
4⤵
PID:7860

C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18168.exe
4⤵
PID:12968

C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
4⤵
PID:14948

C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
4⤵
PID:7592

C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Users\Admin\AppData\Local\Temp\Unicorn-11581.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11581.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:408

C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16321.exe
5⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
6⤵
PID:6320

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
7⤵
PID:7764

C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
7⤵
PID:11360

C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
7⤵
PID:15052

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:4732

C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
6⤵
PID:8352

C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
6⤵
PID:12276

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
6⤵
PID:15276

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
6⤵
PID:17532

C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
5⤵
PID:7028

C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
6⤵
PID:13872

C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14942.exe
6⤵
PID:16900

C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
6⤵
PID:6216

C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
5⤵
PID:8568

C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
5⤵
PID:11860

C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
5⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
5⤵
PID:17672

C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
4⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
5⤵
PID:6872

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
6⤵
PID:11908

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
6⤵
PID:16328

C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
6⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
6⤵
PID:1456

C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
5⤵
PID:8952

C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
5⤵
PID:12572

C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
5⤵
PID:14976

C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
5⤵
PID:18340

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
5⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
4⤵
PID:5324

C:\Users\Admin\AppData\Local\Temp\Unicorn-15989.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15989.exe
5⤵
PID:11536

C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
5⤵
PID:15172

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
5⤵
PID:17424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 17424 -s 432
6⤵
- Program crash
PID:1572

C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
5⤵
PID:7076

C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
4⤵
PID:9268

C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11899.exe
4⤵
PID:14020

C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26920.exe
4⤵
PID:16684

C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1223.exe
4⤵
PID:18352

C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
4⤵
PID:17080

C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:392

C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
4⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
5⤵
PID:6712

C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65272.exe
6⤵
PID:11624

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
6⤵
PID:15848

C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40918.exe
6⤵
PID:18412

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
5⤵
PID:9296

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
5⤵
PID:12696

C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
5⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
5⤵
PID:17996

C:\Users\Admin\AppData\Local\Temp\Unicorn-56430.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56430.exe
4⤵
PID:6408

C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65138.exe
5⤵
PID:13980

C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
5⤵
PID:17324

C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
5⤵
PID:6384

C:\Users\Admin\AppData\Local\Temp\Unicorn-22002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22002.exe
5⤵
PID:11448

C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
4⤵
PID:9824

C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
4⤵
PID:13428

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
4⤵
PID:16660

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
4⤵
PID:16544

C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44874.exe
3⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
4⤵
PID:6620

C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61571.exe
4⤵
PID:10020

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
4⤵
PID:13560

C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33557.exe
4⤵
PID:16736

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
4⤵
PID:4500

C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1398.exe
3⤵
PID:6948

C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
4⤵
PID:18328

C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21464.exe
4⤵
PID:6072

C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
4⤵
PID:18200

C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
3⤵
PID:10000

C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56560.exe
3⤵
PID:13500

C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59170.exe
3⤵
PID:16576

C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
3⤵
PID:18176

C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13683.exe
3⤵
PID:9492

C:\Users\Admin\AppData\Local\Temp\Unicorn-34020.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34020.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780

C:\Users\Admin\AppData\Local\Temp\Unicorn-646.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-646.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312

C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3472

C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61639.exe
7⤵
- Executes dropped EXE
PID:4792

C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14144.exe
8⤵
PID:5864

C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
9⤵
PID:6928

C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50149.exe
9⤵
PID:7504

C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
9⤵
PID:10704

C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58156.exe
9⤵
PID:14308

C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
9⤵
PID:348

C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
9⤵
PID:7416

C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
8⤵
PID:7756

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
9⤵
PID:11648

C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48866.exe
9⤵
PID:15152

C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25986.exe
9⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54191.exe
9⤵
PID:18372

C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
8⤵
PID:10700

C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
8⤵
PID:14176

C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
8⤵
PID:16428

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
8⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46952.exe
7⤵
PID:5344

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
8⤵
PID:7748

C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
8⤵
PID:10288

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
8⤵
PID:14060

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
8⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
7⤵
PID:9180

C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
7⤵
PID:12900

C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
7⤵
PID:16076

C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
7⤵
PID:18260

C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
7⤵
PID:18176

C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58987.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640

C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
7⤵
PID:5388

C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
8⤵
PID:11176

C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
8⤵
PID:14736

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
8⤵
PID:17448

C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41953.exe
7⤵
PID:7920

C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
7⤵
PID:11692

C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
7⤵
PID:15788

C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
7⤵
PID:5568

C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
6⤵
PID:5600

C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
7⤵
PID:10276

C:\Users\Admin\AppData\Local\Temp\Unicorn-49433.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49433.exe
7⤵
PID:14368

C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
7⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
6⤵
PID:8168

C:\Users\Admin\AppData\Local\Temp\Unicorn-46480.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46480.exe
6⤵
PID:12260

C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
6⤵
PID:16068

C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
6⤵
PID:18364

C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
6⤵
PID:6660

C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
6⤵
PID:2488

C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
7⤵
PID:5892

C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32754.exe
8⤵
PID:8624

C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23832.exe
8⤵
PID:12760

C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1477.exe
8⤵
PID:15940

C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
8⤵
PID:536

C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
7⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
7⤵
PID:12140

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
7⤵
PID:15044

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
7⤵
PID:16896

C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32429.exe
6⤵
PID:6104

C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
7⤵
PID:14688

C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
7⤵
PID:18248

C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36146.exe
7⤵
PID:5508

C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
6⤵
PID:8856

C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55446.exe
6⤵
PID:11600

C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
6⤵
PID:15376

C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
5⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
6⤵
PID:5900

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
7⤵
PID:7500

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
7⤵
PID:10664

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
7⤵
PID:14512

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:17652

C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16536.exe
6⤵
PID:7244

C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
6⤵
PID:11484

C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
6⤵
PID:15792

C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
6⤵
PID:17724

C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
5⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10039.exe
6⤵
PID:6708

C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
6⤵
PID:12964

C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
6⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13867.exe
6⤵
PID:544

C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
5⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
5⤵
PID:11456

C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
5⤵
PID:14984

C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
5⤵
PID:17636

C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3572

C:\Users\Admin\AppData\Local\Temp\Unicorn-16452.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16452.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2204

C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
6⤵
PID:3564

C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
7⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
8⤵
PID:7664

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
8⤵
PID:10504

C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
8⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
8⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47455.exe
7⤵
PID:7520

C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
7⤵
PID:11500

C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
7⤵
PID:15868

C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
7⤵
PID:1132

C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
6⤵
PID:6236

C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
7⤵
PID:12008

C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
7⤵
PID:15288

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
7⤵
PID:17620

C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
6⤵
PID:8284

C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
6⤵
PID:12156

C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
6⤵
PID:15348

C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
6⤵
PID:17612

C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21348.exe
5⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
6⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
7⤵
PID:11920

C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46434.exe
7⤵
PID:15356

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
7⤵
PID:17604

C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
6⤵
PID:8928

C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
6⤵
PID:12668

C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
6⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
6⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
5⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
6⤵
PID:7964

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
6⤵
PID:10416

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
6⤵
PID:13992

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
6⤵
PID:2472

C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56879.exe
5⤵
PID:8816

C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41561.exe
5⤵
PID:13100

C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47873.exe
5⤵
PID:16376

C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
5⤵
PID:18256

C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59527.exe
5⤵
PID:4640

C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
6⤵
PID:5216

C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
7⤵
PID:7732

C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35544.exe
7⤵
PID:12268

C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59782.exe
7⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
7⤵
PID:15844

C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
7⤵
PID:6264

C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55711.exe
6⤵
PID:3448

C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27647.exe
6⤵
PID:11464

C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
6⤵
PID:15972

C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61436.exe
6⤵
PID:18368

C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
5⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
6⤵
PID:8072

C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27739.exe
6⤵
PID:12084

C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
6⤵
PID:15032

C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23855.exe
6⤵
PID:18240

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
6⤵
PID:6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47049.exe
5⤵
PID:8240

C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
5⤵
PID:12980

C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55804.exe
5⤵
PID:16360

C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33677.exe
5⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41747.exe
5⤵
PID:6412

C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
4⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
5⤵
PID:6440

C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
6⤵
PID:11088

C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
6⤵
PID:14608

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
6⤵
PID:17504

C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
6⤵
PID:3980

C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
5⤵
PID:8540

C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10629.exe
5⤵
PID:12640

C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
5⤵
PID:15808

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
5⤵
PID:18408

C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29540.exe
4⤵
PID:6796

C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64824.exe
5⤵
PID:8580

C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
5⤵
PID:12708

C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38592.exe
5⤵
PID:15816

C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30697.exe
5⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
4⤵
PID:7700

C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42091.exe
4⤵
PID:13120

C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43408.exe
4⤵
PID:14980

C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
4⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
4⤵
PID:18004

C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176

C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612

C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11843.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
6⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
7⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22459.exe
8⤵
PID:11008

C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
8⤵
PID:14008

C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
8⤵
PID:1388

C:\Users\Admin\AppData\Local\Temp\Unicorn-22002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22002.exe
8⤵
PID:18008

C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
7⤵
PID:8208

C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29759.exe
7⤵
PID:11684

C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
7⤵
PID:15096

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
7⤵
PID:17588

C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
6⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
7⤵
PID:11604

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
7⤵
PID:15804

C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
7⤵
PID:5432

C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
6⤵
PID:6692

C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
6⤵
PID:12252

C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
6⤵
PID:15364

C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19582.exe
6⤵
PID:17548

C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24420.exe
5⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
6⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
7⤵
PID:7524

C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
7⤵
PID:10716

C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
7⤵
PID:14216

C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
7⤵
PID:16416

C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
7⤵
PID:7092

C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
6⤵
PID:7880

C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
6⤵
PID:10580

C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
6⤵
PID:14200

C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
6⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
6⤵
PID:7460

C:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58191.exe
5⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51762.exe
6⤵
PID:8060

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
6⤵
PID:10400

C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
6⤵
PID:14476

C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52201.exe
6⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
5⤵
PID:6784

C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35599.exe
5⤵
PID:10956

C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42296.exe
5⤵
PID:14600

C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36648.exe
5⤵
PID:17512

C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2836

C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
5⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
6⤵
PID:5408

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
7⤵
PID:11824

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
7⤵
PID:16320

C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
7⤵
PID:5708

C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
7⤵
PID:5744

C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
6⤵
PID:8256

C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
6⤵
PID:11884

C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
6⤵
PID:15236

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
6⤵
PID:17628

C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
5⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
5⤵
PID:7292

C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
5⤵
PID:11512

C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
5⤵
PID:15768

C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
5⤵
PID:18268

C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
5⤵
PID:7692

C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
4⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
5⤵
PID:6336

C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
6⤵
PID:10360

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
6⤵
PID:15856

C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
6⤵
PID:18392

C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10959.exe
6⤵
PID:6492

C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54022.exe
5⤵
PID:9040

C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
5⤵
PID:12040

C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
5⤵
PID:15600

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
5⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\Unicorn-15476.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15476.exe
4⤵
PID:7012

C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
5⤵
PID:11664

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
5⤵
PID:15748

C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
5⤵
PID:9476

C:\Users\Admin\AppData\Local\Temp\Unicorn-20303.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20303.exe
4⤵
PID:9112

C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
4⤵
PID:12060

C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28075.exe
4⤵
PID:4040

C:\Users\Admin\AppData\Local\Temp\Unicorn-1488.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1488.exe
4⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57217.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668

C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
5⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
6⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
7⤵
PID:7988

C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
7⤵
PID:11848

C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20869.exe
7⤵
PID:15164

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:4268

C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
6⤵
PID:8276

C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
6⤵
PID:11868

C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
6⤵
PID:15192

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
6⤵
PID:17564

C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
6⤵
PID:4480

C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18605.exe
5⤵
PID:6824

C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
6⤵
PID:11672

C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24002.exe
6⤵
PID:15612

C:\Users\Admin\AppData\Local\Temp\Unicorn-24008.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24008.exe
5⤵
PID:8872

C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52649.exe
5⤵
PID:12584

C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44121.exe
5⤵
PID:15696

C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
5⤵
PID:17724

C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
4⤵
PID:4456

C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
5⤵
PID:6428

C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59192.exe
6⤵
PID:8916

C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
6⤵
PID:11632

C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
6⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
6⤵
PID:5700

C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
5⤵
PID:8336

C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
5⤵
PID:11172

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
5⤵
PID:15264

C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
5⤵
PID:18024

C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
5⤵
PID:1440

C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
4⤵
PID:6940

C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36850.exe
5⤵
PID:11940

C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
5⤵
PID:15252

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
5⤵
PID:17432

C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47087.exe
4⤵
PID:8896

C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6869.exe
4⤵
PID:12608

C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27585.exe
4⤵
PID:15676

C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
4⤵
PID:6844

C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19837.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680

C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38142.exe
4⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49223.exe
5⤵
PID:6344

C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60728.exe
6⤵
PID:9028

C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
6⤵
PID:12552

C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
6⤵
PID:4464

C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
5⤵
PID:8516

C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
5⤵
PID:12200

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
5⤵
PID:15316

C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
5⤵
PID:2412

C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
4⤵
PID:7036

C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9396.exe
5⤵
PID:8772

C:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exe
5⤵
PID:12528

C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3013.exe
5⤵
PID:15728

C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
5⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
4⤵
PID:9152

C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28908.exe
4⤵
PID:13008

C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
4⤵
PID:16208

C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
4⤵
PID:18296

C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
4⤵
PID:9428

C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22107.exe
3⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
4⤵
PID:6540

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
5⤵
PID:8228

C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
5⤵
PID:11876

C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2888.exe
5⤵
PID:15212

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
5⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
4⤵
PID:8532

C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
4⤵
PID:12240

C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
4⤵
PID:15268

C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
4⤵
PID:18204

C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
3⤵
PID:7116

C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
4⤵
PID:11120

C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38104.exe
4⤵
PID:14808

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
4⤵
PID:17440

C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
4⤵
PID:18324

C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
3⤵
PID:9108

C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34445.exe
3⤵
PID:12660

C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
3⤵
PID:14548

C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Temp\Unicorn-43774.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43774.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1072

C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23175.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2420

C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64068.exe
6⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\Unicorn-2243.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2243.exe
7⤵
PID:6360

C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30325.exe
8⤵
PID:7648

C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
8⤵
PID:11332

C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
8⤵
PID:15628

C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
8⤵
PID:17560

C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
7⤵
PID:8308

C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6472.exe
7⤵
PID:12064

C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3569.exe
7⤵
PID:14908

C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
7⤵
PID:17740

C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
7⤵
PID:7456

C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
6⤵
PID:7052

C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
7⤵
PID:7724

C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
7⤵
PID:11492

C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60745.exe
7⤵
PID:15280

C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44783.exe
7⤵
PID:548

C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
6⤵
PID:8796

C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
6⤵
PID:12544

C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
6⤵
PID:15836

C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
6⤵
PID:18324

C:\Users\Admin\AppData\Local\Temp\Unicorn-50350.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50350.exe
5⤵
PID:5272

C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38471.exe
6⤵
PID:6840

C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
6⤵
PID:9004

C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1989.exe
6⤵
PID:12672

C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6802.exe
6⤵
PID:16344

C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55208.exe
6⤵
PID:18212

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
6⤵
PID:3228

C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
5⤵
PID:6168

C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
6⤵
PID:7972

C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
6⤵
PID:10464

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
6⤵
PID:14212

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
6⤵
PID:4644

C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30166.exe
6⤵
PID:5144

C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-875.exe
5⤵
PID:8836

C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23314.exe
5⤵
PID:12560

C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
5⤵
PID:15772

C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4964

C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
5⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
6⤵
PID:6520

C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49138.exe
7⤵
PID:10724

C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47897.exe
7⤵
PID:14580

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
7⤵
PID:17540

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
6⤵
PID:9324

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
6⤵
PID:11380

C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
6⤵
PID:15712

C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
6⤵
PID:3436

C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
5⤵
PID:6928

C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57539.exe
5⤵
PID:9908

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
5⤵
PID:13476

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
5⤵
PID:16612

C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32365.exe
5⤵
PID:7344

C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
4⤵
PID:5556

C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
5⤵
PID:6792

C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
6⤵
PID:11548

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
6⤵
PID:15864

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
5⤵
PID:9600

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
5⤵
PID:12680

C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55980.exe
5⤵
PID:16408

C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22223.exe
5⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
5⤵
PID:18176

C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
4⤵
PID:5364

C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
4⤵
PID:10032

C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
4⤵
PID:13536

C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
4⤵
PID:16556

C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
4⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2348

C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14019.exe
5⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
6⤵
PID:6896

C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46523.exe
7⤵
PID:11732

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
7⤵
PID:16052

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
7⤵
PID:5712

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
6⤵
PID:9624

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
6⤵
PID:12632

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
6⤵
PID:2280

C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
6⤵
PID:18260

C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
5⤵
PID:7300

C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
5⤵
PID:10496

C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40748.exe
5⤵
PID:13472

C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
5⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
5⤵
PID:7392

C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
4⤵
PID:5628

C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12419.exe
5⤵
PID:7308

C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
6⤵
PID:10116

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
6⤵
PID:15752

C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21099.exe
6⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
5⤵
PID:10128

C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
5⤵
PID:13568

C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42223.exe
5⤵
PID:16724

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
5⤵
PID:6464

C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
4⤵
PID:7652

C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
4⤵
PID:10832

C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
4⤵
PID:13988

C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
4⤵
PID:16704

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
4⤵
PID:528

C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
4⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12358.exe
5⤵
PID:6468

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
6⤵
PID:12080

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
6⤵
PID:16304

C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
6⤵
PID:4212

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
5⤵
PID:9260

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
5⤵
PID:468

C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
5⤵
PID:15608

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
5⤵
PID:7152

C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
4⤵
PID:6748

C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
5⤵
PID:11720

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
5⤵
PID:16032

C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14433.exe
5⤵
PID:9412

C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
4⤵
PID:10204

C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49263.exe
4⤵
PID:13740

C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
4⤵
PID:16828

C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
4⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
3⤵
PID:6128

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
4⤵
PID:7288

C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
4⤵
PID:10304

C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
4⤵
PID:14076

C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
4⤵
PID:3800

C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
3⤵
PID:7616

C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
3⤵
PID:10324

C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
3⤵
PID:14460

C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
3⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2808

C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
5⤵
PID:5592

C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58500.exe
6⤵
PID:6752

C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
7⤵
PID:11184

C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39640.exe
7⤵
PID:14728

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
7⤵
PID:17556

C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
7⤵
PID:5376

C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
6⤵
PID:9616

C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
6⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8232.exe
6⤵
PID:16396

C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
6⤵
PID:6772

C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7914.exe
5⤵
PID:2924

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
6⤵
PID:11612

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
6⤵
PID:16280

C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
6⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
6⤵
PID:7772

C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
5⤵
PID:9968

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
5⤵
PID:13488

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
5⤵
PID:16652

C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
5⤵
PID:6764

C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31466.exe
4⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17540.exe
5⤵
PID:8064

C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61554.exe
6⤵
PID:11972

C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
6⤵
PID:15296

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
6⤵
PID:17572

C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
5⤵
PID:10560

C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
5⤵
PID:14192

C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
5⤵
PID:4512

C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64595.exe
5⤵
PID:5852

C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
4⤵
PID:9172

C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37263.exe
4⤵
PID:12888

C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17720.exe
4⤵
PID:16008

C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
4⤵
PID:18308

C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
4⤵
PID:9436

C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47461.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
4⤵
PID:5460

C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53934.exe
5⤵
PID:6624

C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
6⤵
PID:12692

C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
6⤵
PID:13464

C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
6⤵
PID:16548

C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45317.exe
6⤵
PID:11480

C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23496.exe
5⤵
PID:9848

C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21416.exe
5⤵
PID:13420

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
5⤵
PID:16644

C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52712.exe
5⤵
PID:18376

C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
4⤵
PID:6780

C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9215.exe
4⤵
PID:9920

C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26025.exe
4⤵
PID:13528

C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
4⤵
PID:16604

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
4⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8014.exe
3⤵
PID:5880

C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
4⤵
PID:6868

C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
5⤵
PID:10108

C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
5⤵
PID:13904

C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
5⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
4⤵
PID:9308

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
4⤵
PID:11952

C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
4⤵
PID:3252

C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
4⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\Unicorn-31774.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31774.exe
3⤵
PID:7816

C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
4⤵
PID:11396

C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35160.exe
4⤵
PID:15224

C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
4⤵
PID:18408

C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
3⤵
PID:10668

C:\Users\Admin\AppData\Local\Temp\Unicorn-51557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51557.exe
3⤵
PID:14268

C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37895.exe
3⤵
PID:16820

C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31230.exe
3⤵
PID:7372

C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1712

C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
4⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29255.exe
5⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
6⤵
PID:11900

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
6⤵
PID:16288

C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
6⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11233.exe
5⤵
PID:8920

C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9669.exe
5⤵
PID:12604

C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52786.exe
5⤵
PID:15688

C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
5⤵
PID:18284

C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29101.exe
5⤵
PID:6680

C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
4⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
5⤵
PID:11980

C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47010.exe
5⤵
PID:15304

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
5⤵
PID:17416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 17416 -s 432
6⤵
- Program crash
PID:6664

C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
5⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
4⤵
PID:9236

C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
4⤵
PID:12716

C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
4⤵
PID:16216

C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
3⤵
PID:5380

C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
4⤵
PID:6832

C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
5⤵
PID:7812

C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
5⤵
PID:11472

C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
5⤵
PID:16028

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
5⤵
PID:16468

C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
4⤵
PID:8804

C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
4⤵
PID:13108

C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7537.exe
4⤵
PID:13972

C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50600.exe
4⤵
PID:6280

C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
3⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
4⤵
PID:11776

C:\Users\Admin\AppData\Local\Temp\Unicorn-7134.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7134.exe
4⤵
PID:15156

C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
4⤵
PID:17596

C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
3⤵
PID:9252

C:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6168.exe
3⤵
PID:12736

C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
3⤵
PID:15744

C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
3⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4624

C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43454.exe
3⤵
PID:5484

C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
4⤵
PID:6484

C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
5⤵
PID:11288

C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
5⤵
PID:15828

C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
4⤵
PID:9288

C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8968.exe
4⤵
PID:11352

C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26546.exe
4⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62383.exe
4⤵
PID:5740

C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
3⤵
PID:5916

C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
4⤵
PID:11392

C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22555.exe
4⤵
PID:16296

C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54985.exe
4⤵
PID:5584

C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
4⤵
PID:5128

C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
4⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\Unicorn-49859.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49859.exe
3⤵
PID:9744

C:\Users\Admin\AppData\Local\Temp\Unicorn-31282.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31282.exe
3⤵
PID:13728

C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50498.exe
3⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
3⤵
PID:18312

C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
2⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
3⤵
PID:7380

C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39090.exe
4⤵
PID:11764

C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
4⤵
PID:14692

C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
4⤵
PID:18428

C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
3⤵
PID:10344

C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
3⤵
PID:13612

C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
3⤵
PID:16492

C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
3⤵
PID:5800

C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59289.exe
2⤵
PID:7792

C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
2⤵
PID:10600

C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
2⤵
PID:14004

C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42055.exe
2⤵
PID:16692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3252 -ip 3252
1⤵
PID:18116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 16908 -ip 16908
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5080 -ip 5080
1⤵
PID:16912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 17504 -ip 17504
1⤵
PID:18004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7124 -ip 7124
1⤵
PID:6568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 17440 -ip 17440
1⤵
PID:18428

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:16536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 17424 -ip 17424
1⤵
PID:5744

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:6636

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7340

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12394.exe
Filesize
184KB

MD5
d286b854173eeb5f863afc375cffe6c5

SHA1
31d1836714f75d7d2b00577eaf65e43168687281

SHA256
4045a1524db637f2b8760a8f55b76c3d4cde9f25ab937837e23a7858706729a3

SHA512
7f114e61484c1088778c9f2518a141039fa9e1c9b7320c004c52149757f7736649d3f20937e72fceb015cde14ef19b40c7e996882c89be0e07b4e62af4b0ec57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
Filesize
184KB

MD5
611de7496f1f5fb4f3db1bd222956e1f

SHA1
ecc498398f457e9f750989c602436de29e842665

SHA256
48c1b22fa6a545b62332c38d1c26423c656a55a2240420113b486562d750f396

SHA512
322b78c882cc3b6aaadb7f7d2aec25859dc8b17edd8e52725bd026b77c961f10c8f5fe971484bfa0c1bde3369a3d7493674ffb5f28834b6c5226cbecdef8acdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
Filesize
184KB

MD5
874e5228f97040b4397160936cb2045d

SHA1
0efc0eea04e12a4cff6f68c96d18f33cf5e68fc9

SHA256
dc754d5385c54822895b1378309e057c7e552c26fc3eb7b165c70ee49bcf3405

SHA512
403ffb9f849fbf25ed4fa264bc0fe24aeedf730ab7d4c2799e3ac2e10bddf01a0ae7b8f11b2edcc307dbe58ee58a9b322ea735dfbb2a7731fac830b83c5292bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17095.exe
Filesize
184KB

MD5
7723250cb004813041ff63e3d449f404

SHA1
3aca4e1895c53c9d440365c43010e236b8b139f7

SHA256
070415630246d2753ca8092631434aca720c83b0f78c029513b3b4c2bd2406d3

SHA512
34351acc1b08b974f8e041412fbb1dfd83df7fe199f7af0e9ef0e13de01510dd6fb09ec83afcc204dfc7d832cd1f61836e032943cd685398da36509be65108d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
Filesize
184KB

MD5
8e3824e7c8e6f47461716718fe726d2a

SHA1
68242378ef382908148bac55ad1f359a63e2edc0

SHA256
349a9eae541a2ee30909b176d5c00c115a21c360300da3fdb370798e01fb3d6b

SHA512
8a4da5a5c021ba79b799bb4e0a603789b55c78f101659e85e0a922ef1567cfa2dd21111a794ec6ec46435eadf49138bfc73a3b2598067f59f2d135a5b12cf538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26282.exe
Filesize
184KB

MD5
7e7ccc265a5f77a727da7b68919c39ae

SHA1
3d1dce21888148dd2a1e45fd9883ff0aec303951

SHA256
da29a10e24e681dda8913f8b7e5c48a4d1b682c9e83b00360b32088f435e62b5

SHA512
7d3e5e727801c72937d49fd397698bfb091bf4c07a3d1f6b587be342c08ef43cb7913983e7d0dee1a294244b35d9697243479860c207303de37c5748c828ef7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27521.exe
Filesize
184KB

MD5
f2239c590dcc51fcfc96e61a657cd89d

SHA1
be642265e34320bfd6797a6956048484b3e1e59d

SHA256
e8d9ef1104ebfd81a99b992bce4e46e03fc67e1dcb12fa0513c00552d5c4bf6f

SHA512
78eef1395f9e98ef9012e31741554f4441c894f0259bea58c704a5212c7e820403cae3ad8be493a3522ce1e37e03f488eac22559d86ea04f1121279cbbbcbe22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
Filesize
184KB

MD5
f187196217e859d7823e90163957fc8a

SHA1
d03e0dcfb74c00c359a8d262f80dc5b62d28970e

SHA256
0e47f478b5e47762bd0b9527e2384e8f6c7610c367ba59417f037466e3c89ed3

SHA512
6cd394d6c4aa3fef80d36119038d6cdca36c48f70868bea392fd0797f5b40baac380dfd9d5c548a1b6541b605d4cab4a94fc8982fb6656a370ae6c37bd91783a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3124.exe
Filesize
184KB

MD5
0cbb066b1475cdc5c90055fa7bd194ea

SHA1
b7cc35203e7ef7bfe975390a191bba257daf9bd2

SHA256
806673ac99d0b3079e3c87589f7e4aaf43f285a772046b6477a8654a2dfa06ad

SHA512
7522ae39cf71da5e876f55eb3d6228d12c6f12e9e749eb98cc494eff2a626f47a72a9c35e75c1320122ed2dfbf06928fe279927cc8b703f813a7ee232bde1427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
Filesize
184KB

MD5
4b99cada057b69aa1d37a3da2ac6b950

SHA1
dd32e7816d44bc921b42d17a6928a8fc8d5779e4

SHA256
70b454a8dbcf3979440552e39ba9e726d13445f09e446bb1ccdabba043029617

SHA512
7311eec5ce8ed9970b41fc31214302eed11992697a898dd79e5051ffbdc2f241076b9be373407772f1c30f90a5d89e444c8407923fed873373dfb7778c7548a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33156.exe
Filesize
184KB

MD5
c01c649cf2a72508ac11bf05a1b73fc6

SHA1
3b03061fd11a142405ab0e9a1455cf58997c0699

SHA256
77402337021b9b15d010732ef60602afcba9fa274e03c86ee543026c2b5a5e3e

SHA512
a19738d3977cefbd1094499084fb9f4adf9662a0b895d0a41380d0f482b35b6a3c9ec266615b208a08faf019c4946eae9d6eeab545b624433eca609274d3373b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33243.exe
Filesize
184KB

MD5
cddd30aec98ba2339c50a108917241d9

SHA1
9ca24592803c98359fdbc10031fd1fcc43310853

SHA256
83db8092d01e6f05066c6f3fa250856b6d069576ba9f34be985d96925f28026c

SHA512
b2f7589c056f308870910dcea48b37da6412f12359bf9e70bb1858c0b192048517d7a1624100691081cb2ab2d483ee959f5a0bd06a31ee4cb0ba1422e3333fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34020.exe
Filesize
184KB

MD5
8f26460d405e33d3feba8e51a1965297

SHA1
970b6262e643a4280454bcc8da92c86f7f973b72

SHA256
9f23f9ceb4ed5f20cebbba5f65cf17fb8b2b013bff123752f4a3b150c7a50c1b

SHA512
7aa9e61600889479c2a0cc0fbf678956da0dea6b368e41deab8a456ee7260996d3b1a022b4bdf1af0d2db81a1f04cc31e819edc1e510cae2be318584fdf87a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
Filesize
184KB

MD5
79a0a0e9bc425bb3dde15fdf3768eaea

SHA1
f44461c364cf0b91e9d750ea0ffadbc6ce9e2bd8

SHA256
c1c38ead8d97cf56e1e58e6e09a8cd901c202c20e17e0f5ab4e6376d91927abc

SHA512
82b060c45d23fe6f0d8032a99cd4b6b46b3508c2fe9efc2131195007bf2fab5ab3b66deb814b50a295327b841509ab94641c71b3c67c402efa1d1f7d3a143d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36798.exe
Filesize
184KB

MD5
928b724af4bf5f4508431a637219db8d

SHA1
3734f24712ae83e02076373ab9094cf7f0792f97

SHA256
6b7f8a5d4e45b833028e50376e7fee179344140dad2163d738c248be86c39c69

SHA512
2df7e3bad73e2f9e9928bb8d5e410c13d2dc792d36d47a7e86f2095e5b44da865e7d9d78e8658b85ff9743dd501aad428d0bc3b4fd5c146605a96e50cfb33e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
Filesize
184KB

MD5
a190d7bedd6e9be3b9782f18b4bb0e74

SHA1
37a21847615a94c9426c842812d151c73d5b45cd

SHA256
064a064c06d93279f64e81ed4502cf30f5c2c1893c7281d1562823503f32021d

SHA512
b333fccbc85edda4c6e09a33d777182a9fd5ffd46b5b0041950d2f23a2fc0a7bc36d82b7d71f5692bc6f41c1c399c7a8fd687ca564b0500e3968cf386f0702bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
Filesize
184KB

MD5
a2bfa8a651aee555901a4d8ec751caaf

SHA1
c2861906db9c2b646f5431dcc35dce34383f5471

SHA256
4279f8358fc32eabae7692c19628069c3130fa3511450e6e806927434e0894ac

SHA512
7376886a4a0a343b2518e1ef354e3e7123ee46f0b6d07c7349dbd9638741240ee4658afa488c8dd2907d0aef13bdfa76be141fa565ba310e41966f62f64a392d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43774.exe
Filesize
184KB

MD5
e46280191c1b72a6bd9dd906a387802d

SHA1
1588831e977f0db07c76371972b23881ef99f832

SHA256
773ef03da1aad3c919d79db1a0b2052177da23cb7701df334ec91245fc07475e

SHA512
15fc8497ed0f4baa1bfdd1f282f40624537e2df4ff06477f7b00be782e80bb3c048f0b8497c12ce4b446c205f5282cc4442e83d9c1470020d8336103757f253d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44085.exe
Filesize
184KB

MD5
03741ea3be21ec20ed7f930e718b103c

SHA1
7a83b669a12822e1687ef783c2ba7d648534e0a5

SHA256
04729bde5afcf4e3649734fe274851f080d01f85a71c492b87ce5052a1563366

SHA512
99476537c5352e7cfafc0243cd5a08eb706a9e4ece248f7c50190a78670cf2609ff93a95ef2f885186fa8c5b276fb4ff6b5a2389ee4542869037f53bac11ea43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4591.exe
Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46348.exe
Filesize
184KB

MD5
3b291ca1deb604fb9494f708e32dc0d9

SHA1
150abb951fb78499ec9b7d85a58551d78f5efaf3

SHA256
67f6e309e13b82dabda6d16fa709f6901d347e8a25f35b089aa33fd02e88538d

SHA512
9b15ab3ad9428866e71da071a76e49d7ba51f88901192f16eb6c85a1f83d80a91c8aa35846146b5fc0e6e56bee23b2fd8d82e6704a3cedd9e90e50bbb4105b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46991.exe
Filesize
184KB

MD5
e503ff95cb0292e83f8624aa07bf3ec0

SHA1
419fef94b45fa4ef70e6eb07e0b56cede841099e

SHA256
32e1be1f57aebfdfd689b94969c1f6d4c191b5fda1287585b110100e018bccc6

SHA512
4f8e1a5d5373ccd0b1412f85ac87c6d18d3f38b77bfa9d7540d8909a610753fde899ea3052c3db37d5a2cdd0109af62413ee6a4d0a010c8ad8871df396bff3af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
Filesize
184KB

MD5
763d0508b9945c1541d48f4252bb8c09

SHA1
df318ff4a8590d5cdad89b5c78e0d3a24c39c26f

SHA256
d704393a4e06fbf1df7e7a8e08aaaae18592eadd488e207123cb5a1f5932eb29

SHA512
bf439abdc17ffa87796a247fed152c80ee118a35debcb71d265898eac0ceaf778b3025fdfae2dc75ce5f9acb02b230825ba9a074a0d6348b69499ccb6c85cd5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
Filesize
184KB

MD5
2093eb9adbf49254a4e68fd152fa13d2

SHA1
1d95477a17776830441b14f17c39100d76321449

SHA256
c63a77f4c476c2fa44f279d85a444e63cadb548ec1291aa9f5784f0a256febec

SHA512
e06399c10edff62ee3042a6d2bf1559354072b640edfdbe6bb4af7482aaa7236227d0a312780827ff27c23edd5cb9e3f5d647354778a7e971ea14001e2991e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
Filesize
184KB

MD5
50cfb85db7c10195bac71d6d8b6a286d

SHA1
f0b31a3445901d6207fdd06686f2ba001353c587

SHA256
f6f7a5872fefe5ccf3214010486e7af4573b0d90c1f29159a9e805d6af7c26aa

SHA512
6f9eab179ecf7be0439252aeef82b2d677b07fe1dd3f2f2e98bbb1c01dd89e98a9fa2bdc76370cec495ba4eeb9f757490027a56f944ba9a275febc900ba7ccbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
Filesize
184KB

MD5
9bf7ef45be1a7eb0ad30b9aefad4de47

SHA1
977c10bb457fe41e0adcb203ebc870a2325566bd

SHA256
b7a76ad3911c09d8acff8219b5514e5f1f0af0df5dc9aecadd559ffd60c06fe8

SHA512
d89e4b675b7c2fe7f68bac7ba980d2783cdecbbe3a775ff668c6dd146681a9c93c383ff71282bd365bb56b0bb727b20e9f91f24a53caceb40d4516593cfed1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
Filesize
184KB

MD5
1e4bca2ea244da56b12dea07aceaf13c

SHA1
d86d9fed2b4d5f193431a00078bbd704a16dc44a

SHA256
57de464e5036b8fbb1a34fe486af56774ff7ca092f3cd7990a6ddb07b2fc1758

SHA512
22d2a2773c219ae647326470647d8232006ebc7e682854775487402fb95e36bd7a17d38601b830af99a9e77602e1db7bff1c03a864009915c5063a5b90b96ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53736.exe
Filesize
184KB

MD5
08c25e50b45b5884c8e68582d565321a

SHA1
648c377585909149632ec30c19091f4617e5a941

SHA256
fcc3eea9c3d0b2c80d111d3385a0282c218205bfd307e2703634caa37f185a9f

SHA512
17be6a25d228f87507542257841d4be1c4d7d5e8a6c0ee9d323189a228ffca6a582332cea362f8adeced5cdcc39e624c6e2a27a7fe13e1356cbd0f7f2331010d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
Filesize
184KB

MD5
8420933cc3929a7e41d36cef4914acc3

SHA1
7e5f1914ca36dddcf27cbf7f7d71e81da0330841

SHA256
324d2ff34f34835f1e9569f94de6a4697527dda3d192a34887b83fc177638504

SHA512
14f167146381a586960be59552a72558194b574d79cdf84a949240ca18ed61cc69dae38de26710f3a7e6cf378bc3e9ad6270f62877c6bb05baa83c20cd9781ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
Filesize
184KB

MD5
51b5c798db50f26224cfa566a3d23600

SHA1
49689538b4b7b7ab64fc05b860415ada403350d0

SHA256
531a10f4d4ab5514cdc259e6c910f9c7ac25ca3cc4ace4364d71a45438d1d667

SHA512
ad20bd4b35e1b4dbd4dc9c8de59a97afdbdf6494783ee65d4ca26bd24d7ef3675971eccc354e156fa7cf9273e611c24bfa3be71d70669e1fe0674f7b04250a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
Filesize
184KB

MD5
1c1111b61ef36d391116f60fad4ea7e3

SHA1
eb98f5feffd3661a3211209d5a67e339e3182e45

SHA256
7509c5889b1fd577bc9af4f767de2e79219bf011d08f824dec526be23d61d792

SHA512
75449e9fa321ae72726df5c0d2930b0f3fca6925482c66cca791076efb8faba479d4436054998c044378725aca5979cd25de13b49ec053a129e7c6215089b411

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
Filesize
184KB

MD5
d7f2626745deac9345b56ed751093671

SHA1
004d1ac8132c70e0f6e26f120279013272cd64d1

SHA256
c1118dc70737265da98152c694ebb1979e0eed14de1f541b13a8c9143f338c36

SHA512
9337c5c5722af51683037b0abf2b1e7dc3fbd8be03b45ed70bfcf5b11e86dc590f4736e03ec46a92484d1c91b88fa71965ee6ccd05a67f09aab0cd7552f70b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56391.exe
Filesize
184KB

MD5
ec39fa8bc6be5fea852e9922d1df1174

SHA1
fe08d418be827aad1f276988ffb2b1317a5c4e4b

SHA256
5d2ebcedbb8c53c3be8174f30607e2c209efb51d5888aadcf0749b38398aae5c

SHA512
b5d8a63c3584cf55942ebddfa1ac4d71113b265b7b4aae1b7edf2b5e6bf025392a2d19f96181c5caaff6ce5ce531681fac0ab562001b62763fca601b1b8846bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-646.exe
Filesize
184KB

MD5
8dc398ba20fe47c23dddd4ddde7d7499

SHA1
b409a5bb60eccfa21eafd5b93fe65cceb3cd3ce8

SHA256
041eb2d4dfd159cfe7163e1436461630f6530360a995e1a2516d65b731b37e8f

SHA512
694a72c44af812312a328f0bed091a7f02168e0b6a18237dbf70df441fbcdaeb376bac9f06e10a277baff380d05ab8816db7ee3478a97d093b4a3686e59baef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-765.exe
Filesize
184KB

MD5
3d307f5e291d98f97fe9a401accb16ab

SHA1
8a5cc22035a0fcb69af26670724a325c03e76d12

SHA256
9f6a646a3497761c9a560a453a440df32732ad05738a9babfb6bb9b3a31e82c8

SHA512
6c8638e18d9a1d843ddb8a9216bc426043b37c5d83f6e8571f320f5b70b0d64ffcc9f9fd22885d93b2142fa9c4f3e2df26455d2277e5ae347c2c3c38d5d33779

Download Submit
memory/1404-3983-0x00000000769E0000-0x0000000076A5B000-memory.dmp

Filesize
492KB

Download
memory/8316-3761-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/12432-3771-0x00007FFE03460000-0x00007FFE034B9000-memory.dmp

Filesize
356KB

Download
memory/13644-4146-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download