aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe
Size

184KB
MD5

70e70c3cbc7d5643fe655a85d6bd7177
SHA1

510d4b2cbb7bd6b9a317bf4d59879805fd46a939
SHA256

aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421
SHA512

cbf8522c959320c2862c1f04dfc478987b7904cc39e299bfe1b9c5e4158481e4c98b22946a45a960380f4029f0d182dc5d6cc9ac43f39b27bf4a5f6e1cd0b73f
SSDEEP

3072:W/nVJHoJC+4+EfjOWFn8iKoqbvnqnviu:W/bourfjv8FoqbPqnviu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

Processes:

Unicorn-3201.exeUnicorn-54146.exeUnicorn-15121.exeUnicorn-49541.exeUnicorn-59062.exeUnicorn-45327.exeUnicorn-11243.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-2027.exeUnicorn-16338.exeUnicorn-22203.exeUnicorn-22114.exeUnicorn-46518.exeUnicorn-22856.exeUnicorn-40069.exeUnicorn-40069.exeUnicorn-12331.exeUnicorn-32197.exeUnicorn-64988.exeUnicorn-56323.exeUnicorn-9045.exeUnicorn-2145.exeUnicorn-32680.exeUnicorn-46255.exeUnicorn-318.exeUnicorn-7634.exeUnicorn-59436.exeUnicorn-59436.exeUnicorn-47589.exeUnicorn-47589.exeUnicorn-60396.exeUnicorn-45513.exeUnicorn-30376.exeUnicorn-63816.exeUnicorn-28299.exeUnicorn-50800.exeUnicorn-21928.exeUnicorn-55368.exeUnicorn-22623.exeUnicorn-7620.exeUnicorn-52716.exeUnicorn-64905.exeUnicorn-56136.exeUnicorn-31554.exeUnicorn-4548.exeUnicorn-17739.exeUnicorn-35301.exeUnicorn-35301.exeUnicorn-46960.exeUnicorn-50760.exeUnicorn-59619.exeUnicorn-48684.exeUnicorn-27836.exeUnicorn-45480.exeUnicorn-47618.exeUnicorn-13383.exeUnicorn-24466.exeUnicorn-24466.exeUnicorn-30332.exeUnicorn-8007.exeUnicorn-17934.exeUnicorn-15236.exe

pid	process
5072	Unicorn-3201.exe
5080	Unicorn-54146.exe
3380	Unicorn-15121.exe
1308	Unicorn-49541.exe
2088	Unicorn-59062.exe
3968	Unicorn-45327.exe
4424	Unicorn-11243.exe
3632	Unicorn-54757.exe
924	Unicorn-54757.exe
4880	Unicorn-54757.exe
4556	Unicorn-2027.exe
2596	Unicorn-16338.exe
2404	Unicorn-22203.exe
4380	Unicorn-22114.exe
2604	Unicorn-46518.exe
3684	Unicorn-22856.exe
3788	Unicorn-40069.exe
4592	Unicorn-40069.exe
2692	Unicorn-12331.exe
3080	Unicorn-32197.exe
3848	Unicorn-64988.exe
4112	Unicorn-56323.exe
3120	Unicorn-9045.exe
2144	Unicorn-2145.exe
4472	Unicorn-32680.exe
4368	Unicorn-46255.exe
5084	Unicorn-318.exe
4680	Unicorn-7634.exe
2360	Unicorn-59436.exe
2276	Unicorn-59436.exe
3264	Unicorn-47589.exe
4904	Unicorn-47589.exe
1424	Unicorn-60396.exe
3804	Unicorn-45513.exe
1048	Unicorn-30376.exe
5112	Unicorn-63816.exe
3316	Unicorn-28299.exe
4344	Unicorn-50800.exe
2240	Unicorn-21928.exe
3340	Unicorn-55368.exe
3084	Unicorn-22623.exe
3428	Unicorn-7620.exe
2464	Unicorn-52716.exe
364	Unicorn-64905.exe
1272	Unicorn-56136.exe
2720	Unicorn-31554.exe
2696	Unicorn-4548.exe
2136	Unicorn-17739.exe
4532	Unicorn-35301.exe
4900	Unicorn-35301.exe
736	Unicorn-46960.exe
4988	Unicorn-50760.exe
440	Unicorn-59619.exe
1132	Unicorn-48684.exe
4752	Unicorn-27836.exe
2584	Unicorn-45480.exe
2780	Unicorn-47618.exe
1228	Unicorn-13383.exe
4084	Unicorn-24466.exe
3700	Unicorn-24466.exe
2952	Unicorn-30332.exe
3360	Unicorn-8007.exe
1692	Unicorn-17934.exe
4976	Unicorn-15236.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
13108	7136	WerFault.exe	Unicorn-513.exe
13100	7384	WerFault.exe	Unicorn-7140.exe
13796	7460	WerFault.exe	Unicorn-34062.exe
13788	12000	WerFault.exe	Unicorn-30743.exe
16156	12000	WerFault.exe	Unicorn-30743.exe
1776	7052

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E
Key created	\REGISTRY\USER\.DEFAULT\Software
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

svchost.exe

pid process

1376 svchost.exe

pid	process
1376	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

dwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	3640	dwm.exe
Token: SeChangeNotifyPrivilege	3640	dwm.exe
Token: 33	3640	dwm.exe
Token: SeIncBasePriorityPrivilege	3640	dwm.exe
Token: SeCreateGlobalPrivilege	11960
Token: SeChangeNotifyPrivilege	11960
Token: 33	11960
Token: SeIncBasePriorityPrivilege	11960

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exeUnicorn-3201.exeUnicorn-54146.exeUnicorn-15121.exeUnicorn-49541.exeUnicorn-59062.exeUnicorn-45327.exeUnicorn-11243.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-22203.exeUnicorn-16338.exeUnicorn-2027.exeUnicorn-22114.exeUnicorn-46518.exeUnicorn-22856.exeUnicorn-40069.exeUnicorn-40069.exeUnicorn-32197.exeUnicorn-12331.exeUnicorn-9045.exeUnicorn-56323.exeUnicorn-64988.exeUnicorn-2145.exeUnicorn-32680.exeUnicorn-46255.exeUnicorn-318.exeUnicorn-59436.exeUnicorn-59436.exeUnicorn-7634.exeUnicorn-47589.exeUnicorn-47589.exeUnicorn-60396.exeUnicorn-30376.exeUnicorn-45513.exeUnicorn-28299.exeUnicorn-50800.exeUnicorn-63816.exeUnicorn-21928.exeUnicorn-22623.exeUnicorn-64905.exeUnicorn-7620.exeUnicorn-55368.exeUnicorn-52716.exeUnicorn-31554.exeUnicorn-56136.exeUnicorn-4548.exeUnicorn-50760.exeUnicorn-35301.exeUnicorn-17739.exeUnicorn-59619.exeUnicorn-46960.exeUnicorn-48684.exeUnicorn-35301.exeUnicorn-45480.exeUnicorn-47618.exeUnicorn-24466.exeUnicorn-13383.exeUnicorn-30332.exeUnicorn-24466.exeUnicorn-8007.exeUnicorn-17934.exeUnicorn-15236.exe

pid	process
2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe
5072	Unicorn-3201.exe
5080	Unicorn-54146.exe
3380	Unicorn-15121.exe
1308	Unicorn-49541.exe
2088	Unicorn-59062.exe
3968	Unicorn-45327.exe
4424	Unicorn-11243.exe
924	Unicorn-54757.exe
3632	Unicorn-54757.exe
4880	Unicorn-54757.exe
2404	Unicorn-22203.exe
2596	Unicorn-16338.exe
4556	Unicorn-2027.exe
4380	Unicorn-22114.exe
2604	Unicorn-46518.exe
3684	Unicorn-22856.exe
4592	Unicorn-40069.exe
3788	Unicorn-40069.exe
3080	Unicorn-32197.exe
2692	Unicorn-12331.exe
3120	Unicorn-9045.exe
4112	Unicorn-56323.exe
3848	Unicorn-64988.exe
2144	Unicorn-2145.exe
4472	Unicorn-32680.exe
4368	Unicorn-46255.exe
5084	Unicorn-318.exe
2360	Unicorn-59436.exe
2276	Unicorn-59436.exe
4680	Unicorn-7634.exe
4904	Unicorn-47589.exe
3264	Unicorn-47589.exe
1424	Unicorn-60396.exe
1048	Unicorn-30376.exe
3804	Unicorn-45513.exe
3316	Unicorn-28299.exe
4344	Unicorn-50800.exe
5112	Unicorn-63816.exe
2240	Unicorn-21928.exe
3084	Unicorn-22623.exe
364	Unicorn-64905.exe
3428	Unicorn-7620.exe
3340	Unicorn-55368.exe
2464	Unicorn-52716.exe
2720	Unicorn-31554.exe
1272	Unicorn-56136.exe
2696	Unicorn-4548.exe
4988	Unicorn-50760.exe
4532	Unicorn-35301.exe
2136	Unicorn-17739.exe
440	Unicorn-59619.exe
736	Unicorn-46960.exe
1132	Unicorn-48684.exe
4900	Unicorn-35301.exe
2584	Unicorn-45480.exe
2780	Unicorn-47618.exe
4084	Unicorn-24466.exe
1228	Unicorn-13383.exe
2952	Unicorn-30332.exe
3700	Unicorn-24466.exe
3360	Unicorn-8007.exe
1692	Unicorn-17934.exe
4976	Unicorn-15236.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exeUnicorn-3201.exeUnicorn-54146.exeUnicorn-15121.exeUnicorn-59062.exeUnicorn-45327.exeUnicorn-49541.exeUnicorn-11243.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-54757.exeUnicorn-22203.exe

description	pid	process	target process
PID 2152 wrote to memory of 5072	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-3201.exe
PID 2152 wrote to memory of 5072	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-3201.exe
PID 2152 wrote to memory of 5072	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-3201.exe
PID 5072 wrote to memory of 5080	5072	Unicorn-3201.exe	Unicorn-54146.exe
PID 5072 wrote to memory of 5080	5072	Unicorn-3201.exe	Unicorn-54146.exe
PID 5072 wrote to memory of 5080	5072	Unicorn-3201.exe	Unicorn-54146.exe
PID 2152 wrote to memory of 3380	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-15121.exe
PID 2152 wrote to memory of 3380	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-15121.exe
PID 2152 wrote to memory of 3380	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-15121.exe
PID 5080 wrote to memory of 1308	5080	Unicorn-54146.exe	Unicorn-49541.exe
PID 5080 wrote to memory of 1308	5080	Unicorn-54146.exe	Unicorn-49541.exe
PID 5080 wrote to memory of 1308	5080	Unicorn-54146.exe	Unicorn-49541.exe
PID 2152 wrote to memory of 2088	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-59062.exe
PID 2152 wrote to memory of 2088	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-59062.exe
PID 2152 wrote to memory of 2088	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-59062.exe
PID 5072 wrote to memory of 3968	5072	Unicorn-3201.exe	Unicorn-45327.exe
PID 5072 wrote to memory of 3968	5072	Unicorn-3201.exe	Unicorn-45327.exe
PID 5072 wrote to memory of 3968	5072	Unicorn-3201.exe	Unicorn-45327.exe
PID 3380 wrote to memory of 4424	3380	Unicorn-15121.exe	Unicorn-11243.exe
PID 3380 wrote to memory of 4424	3380	Unicorn-15121.exe	Unicorn-11243.exe
PID 3380 wrote to memory of 4424	3380	Unicorn-15121.exe	Unicorn-11243.exe
PID 2088 wrote to memory of 3632	2088	Unicorn-59062.exe	Unicorn-54757.exe
PID 2088 wrote to memory of 3632	2088	Unicorn-59062.exe	Unicorn-54757.exe
PID 2088 wrote to memory of 3632	2088	Unicorn-59062.exe	Unicorn-54757.exe
PID 3968 wrote to memory of 924	3968	Unicorn-45327.exe	Unicorn-54757.exe
PID 3968 wrote to memory of 924	3968	Unicorn-45327.exe	Unicorn-54757.exe
PID 3968 wrote to memory of 924	3968	Unicorn-45327.exe	Unicorn-54757.exe
PID 1308 wrote to memory of 4880	1308	Unicorn-49541.exe	Unicorn-54757.exe
PID 1308 wrote to memory of 4880	1308	Unicorn-49541.exe	Unicorn-54757.exe
PID 1308 wrote to memory of 4880	1308	Unicorn-49541.exe	Unicorn-54757.exe
PID 5080 wrote to memory of 4556	5080	Unicorn-54146.exe	Unicorn-2027.exe
PID 5080 wrote to memory of 4556	5080	Unicorn-54146.exe	Unicorn-2027.exe
PID 5080 wrote to memory of 4556	5080	Unicorn-54146.exe	Unicorn-2027.exe
PID 5072 wrote to memory of 2596	5072	Unicorn-3201.exe	Unicorn-16338.exe
PID 5072 wrote to memory of 2596	5072	Unicorn-3201.exe	Unicorn-16338.exe
PID 5072 wrote to memory of 2596	5072	Unicorn-3201.exe	Unicorn-16338.exe
PID 2152 wrote to memory of 2404	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-22203.exe
PID 2152 wrote to memory of 2404	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-22203.exe
PID 2152 wrote to memory of 2404	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-22203.exe
PID 4424 wrote to memory of 4380	4424	Unicorn-11243.exe	Unicorn-22114.exe
PID 4424 wrote to memory of 4380	4424	Unicorn-11243.exe	Unicorn-22114.exe
PID 4424 wrote to memory of 4380	4424	Unicorn-11243.exe	Unicorn-22114.exe
PID 3380 wrote to memory of 2604	3380	Unicorn-15121.exe	Unicorn-46518.exe
PID 3380 wrote to memory of 2604	3380	Unicorn-15121.exe	Unicorn-46518.exe
PID 3380 wrote to memory of 2604	3380	Unicorn-15121.exe	Unicorn-46518.exe
PID 3632 wrote to memory of 3684	3632	Unicorn-54757.exe	Unicorn-22856.exe
PID 3632 wrote to memory of 3684	3632	Unicorn-54757.exe	Unicorn-22856.exe
PID 3632 wrote to memory of 3684	3632	Unicorn-54757.exe	Unicorn-22856.exe
PID 924 wrote to memory of 3788	924	Unicorn-54757.exe	Unicorn-40069.exe
PID 924 wrote to memory of 3788	924	Unicorn-54757.exe	Unicorn-40069.exe
PID 924 wrote to memory of 3788	924	Unicorn-54757.exe	Unicorn-40069.exe
PID 4880 wrote to memory of 4592	4880	Unicorn-54757.exe	Unicorn-40069.exe
PID 4880 wrote to memory of 4592	4880	Unicorn-54757.exe	Unicorn-40069.exe
PID 4880 wrote to memory of 4592	4880	Unicorn-54757.exe	Unicorn-40069.exe
PID 3968 wrote to memory of 2692	3968	Unicorn-45327.exe	Unicorn-12331.exe
PID 3968 wrote to memory of 2692	3968	Unicorn-45327.exe	Unicorn-12331.exe
PID 3968 wrote to memory of 2692	3968	Unicorn-45327.exe	Unicorn-12331.exe
PID 2404 wrote to memory of 3080	2404	Unicorn-22203.exe	Unicorn-32197.exe
PID 2404 wrote to memory of 3080	2404	Unicorn-22203.exe	Unicorn-32197.exe
PID 2404 wrote to memory of 3080	2404	Unicorn-22203.exe	Unicorn-32197.exe
PID 5072 wrote to memory of 3848	5072	Unicorn-3201.exe	Unicorn-64988.exe
PID 5072 wrote to memory of 3848	5072	Unicorn-3201.exe	Unicorn-64988.exe
PID 5072 wrote to memory of 3848	5072	Unicorn-3201.exe	Unicorn-64988.exe
PID 2152 wrote to memory of 4112	2152	aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe	Unicorn-56323.exe

C:\Users\Admin\AppData\Local\Temp\aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe
"C:\Users\Admin\AppData\Local\Temp\aa7f2bbaf2688990515e6ffc66fd89509e867f2eaf357cf82d74fcdae7931421.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152

C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072

C:\Users\Admin\AppData\Local\Temp\Unicorn-54146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54146.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080

C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Users\Admin\AppData\Local\Temp\Unicorn-47589.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47589.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4904

C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8007.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
9⤵
PID:5660

C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34146.exe
10⤵
PID:7260

C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
11⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
11⤵
PID:7904

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
10⤵
PID:9816

C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
10⤵
PID:13544

C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
10⤵
PID:16644

C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
9⤵
PID:7744

C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
9⤵
PID:10252

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
9⤵
PID:13864

C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43765.exe
9⤵
PID:16164

C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
8⤵
PID:5284

C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
9⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
9⤵
PID:12960

C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
9⤵
PID:14640

C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
9⤵
PID:6008

C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
9⤵
PID:652

C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
8⤵
PID:8776

C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
8⤵
PID:11364

C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
8⤵
PID:15060

C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
8⤵
PID:18236

C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43562.exe
8⤵
PID:9288

C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17934.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
8⤵
PID:6032

C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
9⤵
PID:7552

C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
10⤵
PID:1712

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
9⤵
PID:9868

C:\Users\Admin\AppData\Local\Temp\Unicorn-45919.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45919.exe
9⤵
PID:14308

C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
9⤵
PID:16496

C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32526.exe
8⤵
PID:8000

C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
8⤵
PID:10312

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
8⤵
PID:13844

C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
8⤵
PID:16412

C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
8⤵
PID:7268

C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28245.exe
7⤵
PID:5288

C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1281.exe
8⤵
PID:7292

C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
8⤵
PID:8072

C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
8⤵
PID:10408

C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
8⤵
PID:14740

C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62997.exe
8⤵
PID:4500

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
8⤵
PID:7124

C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46751.exe
7⤵
PID:7684

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
8⤵
PID:12032

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
8⤵
PID:14944

C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
8⤵
PID:17696

C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
7⤵
PID:9952

C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
7⤵
PID:13948

C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
7⤵
PID:15580

C:\Users\Admin\AppData\Local\Temp\Unicorn-45513.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45513.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804

C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64328.exe
7⤵
PID:4392

C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
8⤵
PID:5892

C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe
9⤵
PID:6560

C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
9⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27553.exe
9⤵
PID:14208

C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
9⤵
PID:16676

C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51003.exe
9⤵
PID:8712

C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
8⤵
PID:7920

C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31422.exe
8⤵
PID:10568

C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
8⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
8⤵
PID:16520

C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41187.exe
8⤵
PID:7908

C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53519.exe
7⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
8⤵
PID:8724

C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
8⤵
PID:11312

C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
8⤵
PID:12756

C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
8⤵
PID:18364

C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30852.exe
7⤵
PID:8208

C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50856.exe
7⤵
PID:11012

C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
7⤵
PID:15224

C:\Users\Admin\AppData\Local\Temp\Unicorn-56021.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56021.exe
7⤵
PID:17932

C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
6⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
7⤵
PID:6212

C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62100.exe
8⤵
PID:9028

C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
8⤵
PID:10428

C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
8⤵
PID:2156

C:\Users\Admin\AppData\Local\Temp\Unicorn-31339.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31339.exe
8⤵
PID:5304

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
7⤵
PID:8980

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
7⤵
PID:11656

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
7⤵
PID:15672

C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27281.exe
7⤵
PID:18092

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
7⤵
PID:9792

C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19614.exe
6⤵
PID:6476

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
7⤵
PID:12008

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
7⤵
PID:14920

C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
7⤵
PID:17556

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
7⤵
PID:9780

C:\Users\Admin\AppData\Local\Temp\Unicorn-51442.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51442.exe
6⤵
PID:9112

C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
6⤵
PID:11716

C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
6⤵
PID:15656

C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
6⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
5⤵
- Executes dropped EXE
PID:4752

C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
6⤵
PID:5996

C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
7⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
7⤵
PID:9988

C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34398.exe
7⤵
PID:13812

C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
7⤵
PID:17040

C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56130.exe
6⤵
PID:7228

C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
6⤵
PID:10564

C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
6⤵
PID:14772

C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
6⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
6⤵
PID:9488

C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
5⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31816.exe
6⤵
PID:7192

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
6⤵
PID:9924

C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
6⤵
PID:13996

C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4106.exe
6⤵
PID:3648

C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
6⤵
PID:7508

C:\Users\Admin\AppData\Local\Temp\Unicorn-28296.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28296.exe
5⤵
PID:7880

C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64129.exe
5⤵
PID:10416

C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
5⤵
PID:13428

C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2188.exe
5⤵
PID:16656

C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
5⤵
PID:7868

C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780

C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
7⤵
PID:5356

C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7140.exe
8⤵
PID:7384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 632
9⤵
- Program crash
PID:13100

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
8⤵
PID:9900

C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
8⤵
PID:14240

C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
8⤵
PID:17028

C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
7⤵
PID:7936

C:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16129.exe
7⤵
PID:10432

C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
7⤵
PID:15192

C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
7⤵
PID:17784

C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
6⤵
PID:5180

C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56241.exe
7⤵
PID:8672

C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
7⤵
PID:11488

C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37189.exe
7⤵
PID:7384

C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63243.exe
7⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
7⤵
PID:9220

C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3297.exe
6⤵
PID:8764

C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
6⤵
PID:11348

C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
6⤵
PID:15092

C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
6⤵
PID:18196

C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
6⤵
PID:10004

C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
6⤵
PID:5404

C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
7⤵
PID:6228

C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33873.exe
8⤵
PID:8772

C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23773.exe
8⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57765.exe
8⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
8⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
7⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
7⤵
PID:12788

C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
7⤵
PID:16280

C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
7⤵
PID:17484

C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
7⤵
PID:8808

C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
6⤵
PID:7200

C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28884.exe
7⤵
PID:14036

C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17588.exe
7⤵
PID:16628

C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52552.exe
7⤵
PID:5736

C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
6⤵
PID:9696

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
6⤵
PID:13880

C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
6⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
6⤵
PID:9768

C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
5⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59380.exe
6⤵
PID:8048

C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
7⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
6⤵
PID:10300

C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
6⤵
PID:14660

C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
6⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
5⤵
PID:8452

C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
5⤵
PID:11192

C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
5⤵
PID:15344

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
5⤵
PID:17956

C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16696.exe
5⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3340

C:\Users\Admin\AppData\Local\Temp\Unicorn-41765.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41765.exe
6⤵
PID:5364

C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47077.exe
7⤵
PID:6324

C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
8⤵
PID:11644

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
8⤵
PID:14816

C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
8⤵
PID:18336

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
8⤵
PID:8320

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
7⤵
PID:8956

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
7⤵
PID:11640

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
7⤵
PID:15624

C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
7⤵
PID:5576

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
7⤵
PID:16940

C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
6⤵
PID:6776

C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59604.exe
7⤵
PID:9048

C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
7⤵
PID:11372

C:\Users\Admin\AppData\Local\Temp\Unicorn-30276.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30276.exe
7⤵
PID:15792

C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27499.exe
7⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
7⤵
PID:17348

C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17261.exe
6⤵
PID:9804

C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42994.exe
6⤵
PID:12512

C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31738.exe
6⤵
PID:5116

C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
6⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4712.exe
5⤵
PID:5480

C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
6⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
7⤵
PID:11436

C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
7⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57378.exe
7⤵
PID:5144

C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
7⤵
PID:8184

C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
6⤵
PID:8760

C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37809.exe
6⤵
PID:13456

C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
6⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
6⤵
PID:10656

C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
5⤵
PID:6492

C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
6⤵
PID:9068

C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20986.exe
6⤵
PID:11344

C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
6⤵
PID:15484

C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
6⤵
PID:18056

C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
5⤵
PID:9176

C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
5⤵
PID:11852

C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
5⤵
PID:15560

C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62430.exe
5⤵
PID:4920

C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22623.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3084

C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
5⤵
PID:5332

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
6⤵
PID:6296

C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
7⤵
PID:12052

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
7⤵
PID:14836

C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
7⤵
PID:17452

C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
7⤵
PID:9348

C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
6⤵
PID:9876

C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
6⤵
PID:12784

C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
6⤵
PID:3184

C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
6⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
5⤵
PID:6892

C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
6⤵
PID:12352

C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
6⤵
PID:15996

C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
5⤵
PID:8236

C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
5⤵
PID:13068

C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
5⤵
PID:15116

C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19325.exe
5⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13509.exe
4⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
5⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
6⤵
PID:15084

C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
6⤵
PID:17444

C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
6⤵
PID:9520

C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
5⤵
PID:9096

C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34721.exe
5⤵
PID:11328

C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
5⤵
PID:14876

C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
5⤵
PID:18312

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
5⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
4⤵
PID:6728

C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57367.exe
5⤵
PID:8788

C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
5⤵
PID:11376

C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
5⤵
PID:14792

C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34629.exe
5⤵
PID:18304

C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
5⤵
PID:1480

C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
4⤵
PID:6668

C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
4⤵
PID:13300

C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
4⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924

C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47333.exe
7⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17189.exe
8⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\Unicorn-44663.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44663.exe
9⤵
PID:8100

C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
9⤵
PID:10344

C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
9⤵
PID:14684

C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
9⤵
PID:16664

C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9437.exe
8⤵
PID:8240

C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
8⤵
PID:11076

C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43941.exe
8⤵
PID:15236

C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
8⤵
PID:17944

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
8⤵
PID:17016

C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
7⤵
PID:6364

C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
8⤵
PID:12192

C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
8⤵
PID:14764

C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
8⤵
PID:18348

C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36005.exe
8⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
8⤵
PID:7324

C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
7⤵
PID:8940

C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38859.exe
7⤵
PID:11500

C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58613.exe
7⤵
PID:15584

C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe
7⤵
PID:18132

C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31115.exe
6⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
7⤵
PID:6264

C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45268.exe
8⤵
PID:11592

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
8⤵
PID:14672

C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
8⤵
PID:18320

C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
7⤵
PID:9844

C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
7⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
7⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
6⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21271.exe
7⤵
PID:13708

C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
7⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
7⤵
PID:7284

C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
6⤵
PID:9884

C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
6⤵
PID:3880

C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
6⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18959.exe
6⤵
PID:10480

C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28299.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
6⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
7⤵
PID:8112

C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
7⤵
PID:10276

C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
7⤵
PID:14004

C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
7⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63810.exe
6⤵
PID:7296

C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
7⤵
PID:12272

C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
7⤵
PID:15200

C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
7⤵
PID:5696

C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
6⤵
PID:10760

C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
6⤵
PID:14020

C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
6⤵
PID:17184

C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
6⤵
PID:9576

C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11218.exe
5⤵
PID:5276

C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
6⤵
PID:6528

C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65172.exe
7⤵
PID:8276

C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
7⤵
PID:13168

C:\Users\Admin\AppData\Local\Temp\Unicorn-26971.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26971.exe
7⤵
PID:16272

C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44526.exe
7⤵
PID:6424

C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
6⤵
PID:9824

C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
6⤵
PID:11728

C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
6⤵
PID:15992

C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
5⤵
PID:6692

C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
6⤵
PID:8644

C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51355.exe
6⤵
PID:13240

C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
6⤵
PID:13800

C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
6⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
6⤵
PID:9632

C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33844.exe
5⤵
PID:9152

C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61598.exe
5⤵
PID:11740

C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
5⤵
PID:15616

C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
5⤵
PID:17744

C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24494.exe
6⤵
PID:5184

C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
7⤵
PID:7668

C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
7⤵
PID:10664

C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
7⤵
PID:13756

C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
7⤵
PID:17048

C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
7⤵
PID:9372

C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11533.exe
6⤵
PID:7328

C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48335.exe
6⤵
PID:10348

C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
6⤵
PID:14868

C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
6⤵
PID:16492

C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
5⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
6⤵
PID:6152

C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
7⤵
PID:11684

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
7⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
7⤵
PID:16032

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
6⤵
PID:8972

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
6⤵
PID:11624

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
6⤵
PID:15664

C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
6⤵
PID:18116

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
6⤵
PID:8420

C:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exe
5⤵
PID:6408

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
6⤵
PID:11856

C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
6⤵
PID:14628

C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
6⤵
PID:18384

C:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exe
5⤵
PID:8932

C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
5⤵
PID:11556

C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
5⤵
PID:15528

C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
5⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4344

C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
5⤵
PID:2008

C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
6⤵
PID:7164

C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45812.exe
7⤵
PID:15008

C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
7⤵
PID:17472

C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
6⤵
PID:8868

C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
6⤵
PID:11300

C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
6⤵
PID:15648

C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
6⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5224.exe
5⤵
PID:6716

C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
6⤵
PID:12236

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
6⤵
PID:15132

C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59324.exe
6⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
6⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
5⤵
PID:7288

C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
5⤵
PID:13268

C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
5⤵
PID:13100

C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
5⤵
PID:6860

C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63987.exe
5⤵
PID:8636

C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
4⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
5⤵
PID:7096

C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46980.exe
6⤵
PID:8548

C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
5⤵
PID:8888

C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
5⤵
PID:13252

C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9163.exe
5⤵
PID:15716

C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23860.exe
5⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17417.exe
5⤵
PID:7480

C:\Users\Admin\AppData\Local\Temp\Unicorn-16159.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16159.exe
4⤵
PID:6700

C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
5⤵
PID:12068

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:13104

C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
5⤵
PID:18224

C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17309.exe
4⤵
PID:9168

C:\Users\Admin\AppData\Local\Temp\Unicorn-39847.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39847.exe
4⤵
PID:12776

C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
4⤵
PID:16292

C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
4⤵
PID:1716

C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
4⤵
PID:7148

C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596

C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1228

C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
6⤵
PID:5384

C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-513.exe
7⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 632
8⤵
- Program crash
PID:13108

C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
7⤵
PID:9224

C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
7⤵
PID:13664

C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
7⤵
PID:17128

C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
7⤵
PID:8104

C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
6⤵
PID:7752

C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
6⤵
PID:10672

C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24779.exe
6⤵
PID:13572

C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
6⤵
PID:16712

C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59663.exe
5⤵
PID:5440

C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
6⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12595.exe
7⤵
PID:11616

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
7⤵
PID:14808

C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9220.exe
7⤵
PID:18376

C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
6⤵
PID:9440

C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
6⤵
PID:12212

C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
6⤵
PID:15740

C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
6⤵
PID:10472

C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3314.exe
5⤵
PID:7568

C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
5⤵
PID:9972

C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
5⤵
PID:13956

C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11770.exe
5⤵
PID:2948

C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
5⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24466.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4084

C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
5⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39607.exe
6⤵
PID:7584

C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51191.exe
7⤵
PID:14424

C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2205.exe
7⤵
PID:18040

C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
7⤵
PID:4044

C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
6⤵
PID:10792

C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
6⤵
PID:14084

C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
6⤵
PID:16956

C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
6⤵
PID:7728

C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16683.exe
5⤵
PID:7860

C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-470.exe
6⤵
PID:14824

C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36253.exe
6⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
5⤵
PID:10288

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
5⤵
PID:13904

C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
5⤵
PID:14800

C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48867.exe
5⤵
PID:7396

C:\Users\Admin\AppData\Local\Temp\Unicorn-40255.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40255.exe
4⤵
PID:5196

C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29588.exe
5⤵
PID:7420

C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
5⤵
PID:10648

C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
5⤵
PID:14728

C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
5⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
4⤵
PID:8508

C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61115.exe
4⤵
PID:10248

C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
4⤵
PID:15352

C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41257.exe
4⤵
PID:17964

C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848

C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
5⤵
PID:5672

C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
6⤵
PID:7680

C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
6⤵
PID:10616

C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
6⤵
PID:15176

C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
6⤵
PID:17808

C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15727.exe
5⤵
PID:7968

C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21226.exe
5⤵
PID:10324

C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
5⤵
PID:13852

C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
5⤵
PID:16404

C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
5⤵
PID:7528

C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
4⤵
PID:5448

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
5⤵
PID:6248

C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
6⤵
PID:12120

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
6⤵
PID:15036

C:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55854.exe
6⤵
PID:5628

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
5⤵
PID:8988

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
5⤵
PID:11548

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
5⤵
PID:15592

C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
5⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
5⤵
PID:5560

C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13749.exe
4⤵
PID:6484

C:\Users\Admin\AppData\Local\Temp\Unicorn-30743.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30743.exe
5⤵
PID:12000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12000 -s 468
6⤵
- Program crash
PID:13788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 12000 -s 320
6⤵
- Program crash
PID:16156

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:15160

C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
5⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
5⤵
PID:9796

C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27627.exe
4⤵
PID:7424

C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46333.exe
4⤵
PID:12476

C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23933.exe
4⤵
PID:16260

C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
4⤵
PID:7292

C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2720

C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
4⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24136.exe
5⤵
PID:7520

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
5⤵
PID:9664

C:\Users\Admin\AppData\Local\Temp\Unicorn-8228.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8228.exe
5⤵
PID:2344

C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39493.exe
5⤵
PID:16448

C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11703.exe
5⤵
PID:10220

C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
4⤵
PID:8092

C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
4⤵
PID:10268

C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
4⤵
PID:13920

C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
4⤵
PID:16344

C:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10505.exe
4⤵
PID:9584

C:\Users\Admin\AppData\Local\Temp\Unicorn-47435.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47435.exe
3⤵
PID:5428

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
4⤵
PID:6256

C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
5⤵
PID:12176

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:14616

C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
5⤵
PID:17680

C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
5⤵
PID:6792

C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
4⤵
PID:9188

C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15396.exe
4⤵
PID:11796

C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
4⤵
PID:15552

C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
4⤵
PID:5612

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
4⤵
PID:8616

C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
3⤵
PID:6520

C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15668.exe
4⤵
PID:12060

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
4⤵
PID:14832

C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
4⤵
PID:18292

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
4⤵
PID:9784

C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
3⤵
PID:7272

C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
3⤵
PID:12256

C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44116.exe
3⤵
PID:15496

C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56061.exe
3⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21939.exe
3⤵
PID:5972

C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424

C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4380

C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2144

C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4548.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696

C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
7⤵
PID:5600

C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
8⤵
PID:6308

C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28564.exe
9⤵
PID:11336

C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
9⤵
PID:15824

C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
9⤵
PID:7060

C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
9⤵
PID:17524

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
8⤵
PID:8924

C:\Users\Admin\AppData\Local\Temp\Unicorn-1857.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1857.exe
8⤵
PID:11276

C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
8⤵
PID:8384

C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55346.exe
8⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
8⤵
PID:8500

C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
7⤵
PID:6916

C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
8⤵
PID:14508

C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
8⤵
PID:2264

C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
8⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
7⤵
PID:8348

C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16106.exe
7⤵
PID:13196

C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
7⤵
PID:14636

C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
7⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56300.exe
6⤵
PID:5756

C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18344.exe
7⤵
PID:6572

C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
8⤵
PID:11692

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
8⤵
PID:14724

C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
8⤵
PID:18260

C:\Users\Admin\AppData\Local\Temp\Unicorn-60382.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60382.exe
7⤵
PID:7476

C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25124.exe
7⤵
PID:11532

C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
7⤵
PID:14624

C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
7⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
6⤵
PID:7056

C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13363.exe
7⤵
PID:11732

C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
7⤵
PID:16244

C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
6⤵
PID:9932

C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32509.exe
6⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45950.exe
6⤵
PID:2932

C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17739.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49736.exe
6⤵
PID:5816

C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
7⤵
PID:6372

C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
8⤵
PID:12172

C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
8⤵
PID:16024

C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
8⤵
PID:9524

C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
7⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
7⤵
PID:12796

C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
7⤵
PID:16300

C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46898.exe
7⤵
PID:17596

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
7⤵
PID:8820

C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
6⤵
PID:6936

C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
6⤵
PID:8460

C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
6⤵
PID:13804

C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14164.exe
6⤵
PID:17136

C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
6⤵
PID:6972

C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
5⤵
PID:5864

C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
6⤵
PID:6384

C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
7⤵
PID:11540

C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
7⤵
PID:7732

C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
7⤵
PID:17520

C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
6⤵
PID:10392

C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
6⤵
PID:11848

C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42138.exe
6⤵
PID:16508

C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
6⤵
PID:5716

C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
5⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
6⤵
PID:14588

C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52091.exe
6⤵
PID:18016

C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
5⤵
PID:7628

C:\Users\Admin\AppData\Local\Temp\Unicorn-49463.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49463.exe
5⤵
PID:13624

C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14694.exe
5⤵
PID:17104

C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34776.exe
5⤵
PID:9564

C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988

C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3716.exe
6⤵
PID:5800

C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
7⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
8⤵
PID:11784

C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
8⤵
PID:15336

C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
8⤵
PID:17468

C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44837.exe
7⤵
PID:9976

C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
7⤵
PID:12300

C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16587.exe
7⤵
PID:15608

C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
7⤵
PID:7792

C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
6⤵
PID:7208

C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
6⤵
PID:10608

C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
6⤵
PID:14716

C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
6⤵
PID:16700

C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
5⤵
PID:5836

C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
6⤵
PID:7636

C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
6⤵
PID:11112

C:\Users\Admin\AppData\Local\Temp\Unicorn-7949.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7949.exe
6⤵
PID:14376

C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
6⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
6⤵
PID:9360

C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
5⤵
PID:7872

C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
5⤵
PID:10584

C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28029.exe
5⤵
PID:15204

C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50471.exe
5⤵
PID:17820

C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46960.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:736

C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23042.exe
5⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
6⤵
PID:6672

C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
7⤵
PID:13508

C:\Users\Admin\AppData\Local\Temp\Unicorn-17370.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17370.exe
7⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34458.exe
6⤵
PID:8472

C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
6⤵
PID:12816

C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
6⤵
PID:14504

C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
6⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62796.exe
5⤵
PID:7304

C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
5⤵
PID:9912

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
5⤵
PID:13964

C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
5⤵
PID:1344

C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
5⤵
PID:7776

C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
4⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
5⤵
PID:7240

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
5⤵
PID:9996

C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
5⤵
PID:13988

C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19949.exe
5⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
5⤵
PID:10236

C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10597.exe
4⤵
PID:6680

C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
4⤵
PID:10804

C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
4⤵
PID:13860

C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23532.exe
4⤵
PID:16996

C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33115.exe
4⤵
PID:8860

C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472

C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4532

C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
6⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
7⤵
PID:7248

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
8⤵
PID:12040

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
8⤵
PID:13112

C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
8⤵
PID:18272

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
7⤵
PID:10008

C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36485.exe
7⤵
PID:13412

C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
7⤵
PID:16424

C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50712.exe
7⤵
PID:7896

C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6078.exe
6⤵
PID:7664

C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
6⤵
PID:10320

C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59445.exe
6⤵
PID:14676

C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
6⤵
PID:16532

C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
6⤵
PID:16960

C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
5⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
6⤵
PID:6352

C:\Users\Admin\AppData\Local\Temp\Unicorn-64375.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64375.exe
7⤵
PID:12100

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
7⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
7⤵
PID:18356

C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
6⤵
PID:6648

C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
6⤵
PID:12840

C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
6⤵
PID:16372

C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28148.exe
6⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10226.exe
5⤵
PID:6468

C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
5⤵
PID:8128

C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
5⤵
PID:13676

C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
5⤵
PID:16972

C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42794.exe
5⤵
PID:6808

C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
5⤵
PID:5884

C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
6⤵
PID:3596

C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
7⤵
PID:10864

C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62626.exe
6⤵
PID:10056

C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe
6⤵
PID:13216

C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58357.exe
6⤵
PID:15976

C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
5⤵
PID:7216

C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
5⤵
PID:9656

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
5⤵
PID:13940

C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11284.exe
5⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32329.exe
5⤵
PID:8280

C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
4⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
5⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16305.exe
6⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
6⤵
PID:16732

C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44872.exe
6⤵
PID:3924

C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
5⤵
PID:8540

C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
5⤵
PID:12832

C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
5⤵
PID:16380

C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
5⤵
PID:18048

C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31577.exe
4⤵
PID:7332

C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
5⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45589.exe
5⤵
PID:5188

C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
4⤵
PID:9640

C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
4⤵
PID:13932

C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11814.exe
4⤵
PID:16388

C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5084

C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35301.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6788.exe
5⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
6⤵
PID:7696

C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
6⤵
PID:10508

C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
6⤵
PID:15184

C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe
6⤵
PID:17764

C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5668.exe
5⤵
PID:5512

C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57000.exe
5⤵
PID:10284

C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29294.exe
5⤵
PID:14780

C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
5⤵
PID:16708

C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58445.exe
5⤵
PID:5472

C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
4⤵
PID:6028

C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54128.exe
4⤵
PID:6180

C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
5⤵
PID:12328

C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
5⤵
PID:15572

C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64700.exe
5⤵
PID:3488

C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
4⤵
PID:8900

C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
4⤵
PID:11872

C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17853.exe
4⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
4⤵
PID:18248

C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
4⤵
PID:10476

C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59619.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:440

C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15723.exe
3⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
4⤵
PID:6552

C:\Users\Admin\AppData\Local\Temp\Unicorn-64375.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64375.exe
5⤵
PID:12048

C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
5⤵
PID:15724

C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
5⤵
PID:2688

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
5⤵
PID:9788

C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
4⤵
PID:9196

C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
4⤵
PID:12824

C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
4⤵
PID:15288

C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
4⤵
PID:5776

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
4⤵
PID:9340

C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
3⤵
PID:6884

C:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11542.exe
4⤵
PID:12812

C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
4⤵
PID:16172

C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
4⤵
PID:6380

C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
4⤵
PID:11948

C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2569.exe
3⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
3⤵
PID:12208

C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2036.exe
3⤵
PID:13780

C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
3⤵
PID:5912

C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632

C:\Users\Admin\AppData\Local\Temp\Unicorn-22856.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22856.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3684

C:\Users\Admin\AppData\Local\Temp\Unicorn-47589.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47589.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3264

C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62024.exe
6⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
7⤵
PID:6828

C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
8⤵
PID:13408

C:\Users\Admin\AppData\Local\Temp\Unicorn-47381.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47381.exe
8⤵
PID:17080

C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
8⤵
PID:5740

C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
7⤵
PID:8044

C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
7⤵
PID:13076

C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24171.exe
7⤵
PID:232

C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
7⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25005.exe
7⤵
PID:9688

C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
6⤵
PID:5416

C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64680.exe
7⤵
PID:7276

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
7⤵
PID:9964

C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
7⤵
PID:13912

C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
7⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
7⤵
PID:9556

C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59635.exe
6⤵
PID:7780

C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
6⤵
PID:9612

C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
6⤵
PID:13888

C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60286.exe
6⤵
PID:3984

C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
5⤵
PID:1948

C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1295.exe
6⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36116.exe
7⤵
PID:13064

C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
7⤵
PID:18096

C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24107.exe
6⤵
PID:8040

C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
6⤵
PID:13652

C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16596.exe
6⤵
PID:16780

C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55539.exe
6⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
5⤵
PID:6344

C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
6⤵
PID:10148

C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48094.exe
6⤵
PID:12656

C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
6⤵
PID:2756

C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52056.exe
6⤵
PID:14056

C:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45224.exe
5⤵
PID:8948

C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
5⤵
PID:11808

C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
5⤵
PID:15536

C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
5⤵
PID:5652

C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
5⤵
PID:16228

C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1424

C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
6⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
7⤵
PID:7232

C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
7⤵
PID:9500

C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
7⤵
PID:13696

C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
7⤵
PID:17016

C:\Users\Admin\AppData\Local\Temp\Unicorn-34583.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34583.exe
7⤵
PID:10340

C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65225.exe
6⤵
PID:8060

C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
6⤵
PID:10356

C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
6⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
6⤵
PID:16892

C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
6⤵
PID:7380

C:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exe
5⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
6⤵
PID:7928

C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
6⤵
PID:11180

C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
6⤵
PID:13344

C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
6⤵
PID:16948

C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
5⤵
PID:7736

C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
5⤵
PID:10960

C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
5⤵
PID:15040

C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1018.exe
5⤵
PID:17428

C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
4⤵
PID:2196

C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
5⤵
PID:6096

C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
6⤵
PID:7644

C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
6⤵
PID:11168

C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
6⤵
PID:13768

C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
6⤵
PID:17124

C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
6⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30222.exe
5⤵
PID:8076

C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
5⤵
PID:10332

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
5⤵
PID:13872

C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
5⤵
PID:16288

C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46921.exe
5⤵
PID:10196

C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
4⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40983.exe
5⤵
PID:8716

C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
5⤵
PID:11320

C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
5⤵
PID:14488

C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25963.exe
5⤵
PID:18284

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
5⤵
PID:8600

C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57295.exe
4⤵
PID:8520

C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
4⤵
PID:12940

C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18531.exe
4⤵
PID:15328

C:\Users\Admin\AppData\Local\Temp\Unicorn-51890.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51890.exe
4⤵
PID:5488

C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
4⤵
PID:9776

C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48226.exe
5⤵
PID:5296

C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
6⤵
PID:6340

C:\Users\Admin\AppData\Local\Temp\Unicorn-50836.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50836.exe
7⤵
PID:12184

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
7⤵
PID:15140

C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
7⤵
PID:17564

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
7⤵
PID:9268

C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
6⤵
PID:9056

C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
6⤵
PID:14032

C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6820.exe
6⤵
PID:16984

C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
6⤵
PID:7832

C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
5⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7460 -s 632
6⤵
- Program crash
PID:13796

C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
5⤵
PID:9672

C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
5⤵
PID:13896

C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30827.exe
5⤵
PID:16432

C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
5⤵
PID:7580

C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
4⤵
PID:3092

C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63912.exe
5⤵
PID:7088

C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
5⤵
PID:8036

C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2494.exe
5⤵
PID:13704

C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9124.exe
5⤵
PID:16864

C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27346.exe
4⤵
PID:7588

C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58507.exe
4⤵
PID:10068

C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24561.exe
4⤵
PID:13972

C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13524.exe
4⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
4⤵
PID:9740

C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30332.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
4⤵
PID:5496

C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
5⤵
PID:7892

C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5303.exe
5⤵
PID:10696

C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
5⤵
PID:14756

C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
5⤵
PID:16396

C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17117.exe
4⤵
PID:8216

C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
4⤵
PID:11140

C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
4⤵
PID:15164

C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49941.exe
4⤵
PID:17800

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
4⤵
PID:8008

C:\Users\Admin\AppData\Local\Temp\Unicorn-63686.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63686.exe
3⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
4⤵
PID:8176

C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
4⤵
PID:10488

C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
4⤵
PID:14748

C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
4⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\Unicorn-38813.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38813.exe
3⤵
PID:8528

C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12643.exe
3⤵
PID:10404

C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39267.exe
3⤵
PID:14356

C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2482.exe
3⤵
PID:18108

C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404

C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3080

C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
5⤵
PID:4280

C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
6⤵
PID:7104

C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12950.exe
7⤵
PID:15212

C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64094.exe
7⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
6⤵
PID:8896

C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
6⤵
PID:11584

C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
6⤵
PID:15072

C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
6⤵
PID:18396

C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
5⤵
PID:6952

C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55607.exe
6⤵
PID:15216

C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39005.exe
6⤵
PID:17776

C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
6⤵
PID:9592

C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
5⤵
PID:10040

C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
5⤵
PID:12312

C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
5⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
4⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
5⤵
PID:7112

C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
6⤵
PID:16668

C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
5⤵
PID:8880

C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-337.exe
5⤵
PID:13420

C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20436.exe
5⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52778.exe
5⤵
PID:11936

C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
4⤵
PID:6636

C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46161.exe
5⤵
PID:12580

C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
5⤵
PID:16008

C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4955.exe
5⤵
PID:5848

C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
4⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52306.exe
4⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49716.exe
4⤵
PID:15548

C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
4⤵
PID:6016

C:\Users\Admin\AppData\Local\Temp\Unicorn-52716.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52716.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17349.exe
4⤵
PID:5268

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
5⤵
PID:6240

C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
6⤵
PID:10592

C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
6⤵
PID:14700

C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
6⤵
PID:17752

C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1043.exe
6⤵
PID:9244

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
5⤵
PID:8964

C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
5⤵
PID:12080

C:\Users\Admin\AppData\Local\Temp\Unicorn-10381.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10381.exe
5⤵
PID:13180

C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47541.exe
5⤵
PID:18212

C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
5⤵
PID:8152

C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14.exe
4⤵
PID:6504

C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55284.exe
5⤵
PID:8360

C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
5⤵
PID:12572

C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
5⤵
PID:16036

C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
5⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
4⤵
PID:9160

C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
4⤵
PID:12768

C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
4⤵
PID:16312

C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
4⤵
PID:444

C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18613.exe
3⤵
PID:5388

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
4⤵
PID:6288

C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33457.exe
5⤵
PID:12216

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:15020

C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
5⤵
PID:8612

C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
5⤵
PID:16956

C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
4⤵
PID:9836

C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57710.exe
4⤵
PID:12112

C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42898.exe
4⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
4⤵
PID:9628

C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
3⤵
PID:6900

C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53746.exe
3⤵
PID:8304

C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56443.exe
3⤵
PID:13204

C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
3⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
3⤵
PID:10112

C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4112

C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3428

C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23976.exe
4⤵
PID:5312

C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47845.exe
5⤵
PID:6388

C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
6⤵
PID:12244

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
6⤵
PID:15128

C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
6⤵
PID:17644

C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44785.exe
6⤵
PID:10384

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
5⤵
PID:9012

C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5121.exe
5⤵
PID:12400

C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
5⤵
PID:15980

C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
5⤵
PID:17640

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
5⤵
PID:7620

C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32686.exe
4⤵
PID:6628

C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
5⤵
PID:12160

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
5⤵
PID:16740

C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
4⤵
PID:9856

C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
4⤵
PID:12132

C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32605.exe
4⤵
PID:3948

C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2574.exe
3⤵
PID:5464

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
4⤵
PID:6232

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
5⤵
PID:12136

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:15052

C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58146.exe
5⤵
PID:5156

C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51697.exe
5⤵
PID:9516

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
4⤵
PID:8996

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
4⤵
PID:11600

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
4⤵
PID:15508

C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42741.exe
4⤵
PID:5592

C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26496.exe
4⤵
PID:3504

C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
3⤵
PID:6624

C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
4⤵
PID:10516

C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
4⤵
PID:14368

C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31617.exe
4⤵
PID:18120

C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
3⤵
PID:9456

C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
3⤵
PID:13088

C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24701.exe
3⤵
PID:4956

C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14860.exe
3⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39835.exe
3⤵
PID:7468

C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:364

C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
3⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10180.exe
4⤵
PID:6280

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
5⤵
PID:11888

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
5⤵
PID:14860

C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
5⤵
PID:17580

C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25623.exe
4⤵
PID:9004

C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
4⤵
PID:11636

C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
4⤵
PID:15516

C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
4⤵
PID:18076

C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
4⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12338.exe
3⤵
PID:6980

C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50644.exe
4⤵
PID:11968

C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32347.exe
4⤵
PID:16236

C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
4⤵
PID:9464

C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
3⤵
PID:9944

C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49045.exe
3⤵
PID:12148

C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
3⤵
PID:2936

C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
3⤵
PID:7064

C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
2⤵
PID:5396

C:\Users\Admin\AppData\Local\Temp\Unicorn-44898.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44898.exe
3⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
4⤵
PID:12024

C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56318.exe
4⤵
PID:14972

C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40971.exe
4⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49752.exe
4⤵
PID:10900

C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
3⤵
PID:9448

C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10241.exe
3⤵
PID:13236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32837.exe
3⤵
PID:13184

C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29643.exe
3⤵
PID:6996

C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49635.exe
3⤵
PID:7952

C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62072.exe
2⤵
PID:7536

C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23506.exe
2⤵
PID:9648

C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
2⤵
PID:13980

C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
2⤵
PID:16480

C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
2⤵
PID:9408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7384 -ip 7384
1⤵
PID:11844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7136 -ip 7136
1⤵
PID:11984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7460 -ip 7460
1⤵
PID:13596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 12000 -ip 12000
1⤵
PID:13672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 11584 -ip 11584
1⤵
PID:14416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 11584 -ip 11584
1⤵
PID:14628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 12000 -ip 12000
1⤵
PID:15820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:1376

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe

Filesize
184KB

MD5
ed30adac332639f742d8a7c7aeda3aaa

SHA1
bccc8dfea83233c3a90a5b299ee8c00410854478

SHA256
bfb032a6d2b0e9f9544ba059fb54b3985ec355e8470d00fc1da83fba571877db

SHA512
a39e349794e949fad0242e9bd7dea803089e2c626cb6b648b0e9fa1cde5664f241d84d80db49079b5313f5cf7ddbc5a0d18818540e03f4b143429ff6e643a35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12331.exe

Filesize
184KB

MD5
a234da211f5239caf21ef9ba4f521e05

SHA1
730a0fcfb1fd0639f3f34d3311099874986428f8

SHA256
2ecabe7ee11251ae08f63514a024456ac0fb80a625149aba22dcfed997677342

SHA512
f484f3a1898b17b6f5f1a760e0315070a69bcb09d9180d16e2e3727ab9a9319427ec174898ac2282f75d28eacabb08d86990abd0152510014cf615005b66edc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe

Filesize
184KB

MD5
acdc72ec88c3ad4ad4ebac159e69118c

SHA1
0e946ddbba765edb50e5e4b07ef0ca67f7930377

SHA256
c3c870979d20e6c04e9421ef05bad934fca58d6d2ae737339ec33ba0256a2559

SHA512
d094b95c421222505f5eea5e2ebea5fc46d957eb0209118935fb32c787236519981223ef9d91cbeb0adb3d0dde394de18d94523dab0c23da2854fd546c47dab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe

Filesize
184KB

MD5
2bdd36bd58a93fcf0cfe9500935592a3

SHA1
88e006d002ec7c256102ff649907e8de9cb74796

SHA256
af46a512e3ca3877e6908e2bbe7c9e6be01d8c694094b282b86951751a23371d

SHA512
554c18e9710ae034b994e2c17a8241f2dcbaabeb7b18359365b09cdfaf9cf64b332334917d0b838d6c8c8c87a41437fa06de8b3cf134e093b94d26fc2a477dc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17450.exe

Filesize
184KB

MD5
afeca54472f9e424b7eea6319cbeb84c

SHA1
23e6f240083767aff18bc4f51528f51be6c681cd

SHA256
44013d8a780e0fd0e62f7286dcddaa9c5baa9587917795444e1bc3f75c88cece

SHA512
2ecb950d78589b163612bd0f77b4ace1b0cfd8c9b0a1a9719ae98d74e0300ed2f4dd13e5e0dad90643aabed7f191514f2a7a5cc8140696f9c89121606a169188

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe

Filesize
184KB

MD5
ad5be30dc309cd6a4f6e675dc5152b88

SHA1
c634db2f573a06aa7533a8cc45082268f3416f55

SHA256
f2a7f71b4a17766382681d7e2e59c57c40d79fd6c38d048eef39d1dc452d29fa

SHA512
29c9091b0cbac1747f9cbfe9ce646366ab566e72cb1c1148f6ad95728cb0348bcc6d997c37e27a267fc4338a00b14853a28eea2d342e8ca9936073397b99ab3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2145.exe

Filesize
184KB

MD5
ff7f677ec7375a666ccb8a6c75e9925d

SHA1
88e10433d05990e419c261666121aa890c17ed2b

SHA256
f52cf6e91c2c79b67f083ff47fff27aaefe62a419190848a8e524135637ae154

SHA512
f18788eaa46cbfb381ceb4f0f926d033f7a4da33420447cc8af6c8ab5fa56365962ed6ad1e6650e51bdac49a9f460f79aee53b8592ab9bf4273394c4df160e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe

Filesize
184KB

MD5
9b7646aae2eae84ba157be62ebdbbebb

SHA1
44ed31d37459cb67127eb0779a1b55fde94f79a6

SHA256
fb1e90888cbe85ecdc23be23328564dfa204bd99c477d80765259643c439af5a

SHA512
031851f1b47c777384e2fd66d1ed68410143b63e8896c77ecef1e3c38b6d9a98a8b595b8509e9a5af10067f3147c366d11236ea39cccbf5585dfb34eb083f743

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe

Filesize
184KB

MD5
b755e664116e7c7ab5785b8acf04855e

SHA1
4ee2d8b7af463a3052dd62ff42ea8042f08502c8

SHA256
914919500384429abcd274c42b5ff88a9ea0de2a9b83c85e52b4685bd001acfd

SHA512
8958d90ee6eca25d9266b820236b7578a9b8e0b942672f2e2808178b8b55d9903bb23d9081e4876526dd9e8ba658ec24885d4953c6a97d9e5eb5bd460fbcb1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22856.exe

Filesize
184KB

MD5
f67debba82a21d217d66c70ad712732a

SHA1
31ffd7211d4419b0f0394cb30ba6d14f62e9b066

SHA256
6e15ea9c954ffab150baf9d38ce6c70a24b13c524f851898f8150b349cae0e70

SHA512
fbabcc1996a8e48249868835f4ca340a222193c939386252ac24316c02c3d70856e67f5a31e267923cd7a6cc103b70c9947aba2d0e793528c865ff70a71ea18c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-318.exe

Filesize
184KB

MD5
0be2324a3d4772391035f053d8fa2140

SHA1
1ef41fed1ffe63066dcb13f2871aba3d8275ad68

SHA256
59a7fa5e2cb7e12697c254483e9e6af89a675781efe7123bb03f900a37fe5d5f

SHA512
3eeae82d59cd59d780dd4b10a92369770374dddb465ce026c8bcbbf3334e67766df673ac696fba89342397b8b431213548087991faa431423712e85ce3587c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3201.exe

Filesize
184KB

MD5
cbd320526e90981293a3aadecf08c5d8

SHA1
d9719d875cec1846a046739fd54b9ce928ca1672

SHA256
c5b5ea56b9ca57cac83c41c34d5195b724068cdfcaf1d05bed609fe0cbab5b6e

SHA512
8b73d42f4cb817779f30078fb4329cf2de7daf45fa593b73306b31b17269a29a90ab09c9630e7d9e563ce9d09e07a893f771d3e0f2795fb28407f7d02d13211c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32197.exe

Filesize
184KB

MD5
a4134da7c9e09c0bd02c89d900b078b2

SHA1
f4c6e66e541559338ccbee85bb144417c432c8d8

SHA256
342641427929241a43d07ec6d755e636c349ff3fd8f2784e32edae7bdd8b5ea7

SHA512
9b032e060ace8bdd5e9c0b2779453b18f469410680d861c07e7db60c3f2ebcd153ef728d4fd3e4fc877842e2b3b253a2841a4044f370874a25bd918e6ab77289

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe

Filesize
184KB

MD5
67fd8182cf5f0ecbc730e2e0fccaf591

SHA1
61967f6ae4af06873ca9aad595e31cf159d7b225

SHA256
e5d3ad34104cfb6b563fb1137e23bdc8b2a42399b8fa687d6216ecc925100d2b

SHA512
e17b9ddb7a95b70e8e28ff842d8a586c889d3c424d0747f02dbbab08c7f31c4136dbbae00d9fee602fdda429617df770cb5a5cc2a8a45cfd752136c80d07ce75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33405.exe

Filesize
184KB

MD5
3b6df916f0cf9f2560ffe023ac908395

SHA1
f3c67b5a554bcaa2532650eea611acfcd158e1ce

SHA256
e5735929e01e3695b90ed436d3f83270d31a99447410de2eee09f1177dc84163

SHA512
135c8cc3da40571daa2b5d70e99dfb3e4be4713d95e7dda291e8e4f9241035c974e1c3beaa776c772b1329bd30983d2f122ab17f3adfdf69509598371ca57e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe

Filesize
184KB

MD5
79c3e4c3bdf9356d8833c3828c6da830

SHA1
639a6c0fff7dde7ceed6e1383dbb5ce5eefa7781

SHA256
b7bc9818d5c9184af000825fd3144c2daed12cf898e18ae66b4e97c363720190

SHA512
5f300aa54ae8c8ca1990610f926b3e99095bef165fedd1362d21bf17b6ab9d61597a53077c82653538ad5a5629d6484c702502ebfbd14af5b358b47f5d7622d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe

Filesize
184KB

MD5
6b3fd5b6c2b4f323c7e875db13c764a4

SHA1
fa16be4d100d052d5f15525238496a9f8f52bc24

SHA256
7e82ceae98eea37b2fde127893763fc566eebb3e69cc177911e4c0ccf19f223f

SHA512
75c631a3f338de01042eb49cb87ba8dd333640ce9ac0a5702a8835edb69527d99a8ffcbf46cb8981302e4fcbf0d85a872e304f7ee2d226fef4f5e9fcdc4a5adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe

Filesize
184KB

MD5
640c9a198b824e71575e1a30761dadde

SHA1
efa46e92c1a38aed3f232c891acb04a5e89483d3

SHA256
d1686ab6240034ad42539cc740fd9891683765961d0276d2e7cca384a30db068

SHA512
45374068f88a149b3ef0dca0095149bfa2525831297efb89f14014afdff95f39a44f258319de3f428296a831ba96bc766df783d291a591bba4bb7c5e78941b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46255.exe

Filesize
184KB

MD5
5cc0dd5b307a08a74603e589715185ab

SHA1
c803d5760d8cef3c6280baacc6fbb6c62c76bfbc

SHA256
0787caa2f674b4359b4d3bac300bb26984977418bf53d93a270b56a51dce45d5

SHA512
83b649f86d6e057b5e6f36ffe4f160d3d8565f16c08c3b8e377f9ba8b3df9c6f50abde928457b7398a6652e08b1083d3272fa5d8cdab2d164e2326e2cc913a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe

Filesize
184KB

MD5
0f361f10278e92a38d104a00f5697b28

SHA1
532207cc9c103a6bf068a0f24e554bbbbb0fa4b8

SHA256
f112e427c0087c9a990dcaac791f092ae275d03576d5a91c5a416c28ff3afbc3

SHA512
9d34e8935033ca09122b7bf9a0ab1b45846a88e69e070111f00dc6393ace7665a99ec1d6548b6afc2f1a71b748cc30a08a83a97b00901705f645cafe24164ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47589.exe

Filesize
184KB

MD5
cf0e27d5308f5e4c014040ea6122c9ba

SHA1
141153c6fa06db466f5543c16326388f89a36ed1

SHA256
ef7bd21995d5971353ed95bd0ca338709f391bfcde4d8f61982eab08d5b34817

SHA512
1ffd67a844a2120a34eebd64e310e2d3042c56427d7fb8776ce43a0908d337eac4f94dacf75a36bda7415cf17f227185ac66aaeb73427974c58f45732ccd6871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe

Filesize
184KB

MD5
97414eac7af2a203230cc3ce3dc52355

SHA1
a9854983a1951fcfdb59d7f96f55ba7d74df274b

SHA256
23a0e0ab22618b44e8cc36886a3fd39d349e3a9bb675512b672337419d014f01

SHA512
cad26c7f58c19c41951f2efc7a22feff824242245f5c2d834eecabcaa84182a1e201d215205c9e9685cecf767b9546e35b184b61108dea705fe61c62b8b206f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49541.exe

Filesize
184KB

MD5
23859f9a4ecf07173e8d10b9ee22d19f

SHA1
bd47460f417fb796ab88dec22b9b6557ebe7da73

SHA256
c87e2ad5974a6d658d2dcb345d316e4c475cfc102343865dda8fa0eab6e892ea

SHA512
95b8f5c8e36c0789eb1d66ca0d2237ba8ff71b573f28ce3a9a00b6afdabfa214b9691a3871fcc87b509adadddf11a64bde52d50620aeebf5d10f06da5d53d12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54146.exe

Filesize
184KB

MD5
7733d03950276e65f34f9e6d1638a8bf

SHA1
a66f1a833538226997af59f5638b960ec8c648ac

SHA256
8adbbadc723c7cdf92761d6847f926bf5f9f6e4a0ce463e348a0a0b15c540dd8

SHA512
adfc867c17f36dace27a6a4318696ba882ae4a753f177daca7c46a242dc91d82b1e47e80144c3b07ff394801c5a6f4ac35aa12fdb1942aa921e983fd5ec0d38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54757.exe

Filesize
184KB

MD5
d6ef8ff5aa4fbf1e65091d0922e1c16b

SHA1
0dcb9f4819d13220ce95d76bdee1f1309b1b3bf5

SHA256
98904b35b990cacfbc398ae7777b676b49f69d2ba2e6bf6224968cabc295615b

SHA512
b2fe356379e597c5ae289a25ebecc900dea8d27bf0b01de27fed5dc76e6f87379521a54865c6945843097a4081f87b9a01b7bd71e90504a734a9d74e2b123315

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56323.exe

Filesize
184KB

MD5
919351ec69ecabc1f04ab77db70ffe62

SHA1
65bb0bb1c746206e2453488cb0935dbe03dae947

SHA256
a98fe21de473a371406ef983f4b70199f243de6675b8faf9725e8e3a254b5343

SHA512
af4286aed1d3d26e2d337095dcc467a71711a133fe01d1a60b80da9dad549c649c812cae3e4b77af37371165184a90dda94bde661b38dd967acb709e496dd521

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe

Filesize
184KB

MD5
94c53e36fd31607f2a4251548f82780d

SHA1
2a891dff84fa757744ae3fd3cd4e302d207b42b7

SHA256
8398f7a42630a117b6acbb6eda362e74d417048b4be1feced57d95a728d79a2c

SHA512
fed8cfe28f972d9ad2e73847398bfdd70268ed6a298eefb18dd7b18a3ae0e066594320baa70e775626600b8f389f1ecb0a9cab39e9b25d53734fdf0b557ffcd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59436.exe

Filesize
184KB

MD5
43bb0ca73fd78657b39c3de6ff222192

SHA1
3f7bf4aeac4a2b60903b4f61b590b8d9b7319ed9

SHA256
a13c3a25a5675725249ba8edf5a745f3462648729aa93f4e7b46ab6dedf2cf34

SHA512
9bac42fb65e158941a403c55a1f9fdd38e4552cc577a3d2a5dabe4e87cec83bcc08d5f94174f2ad4af83500ffa7da8b2b9726a1b8aa7be6392f74583df479093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe

Filesize
184KB

MD5
3742720ced77c8a5c8866bb24bb1cede

SHA1
0b1f4d8de38dc16fef7863ac093d55865fa3fc7b

SHA256
87977cbd4f400db304d3ee91f88788fc0d70d9cdc29a6477d1e5696623869727

SHA512
cf499524224696b245b34d77af1b127078fbafb9956b2b7e47334e98dec98c35ffd8196a52790e7da40393fa2450f29fce22947e0fd743b092ea798c3c44f607

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7634.exe

Filesize
184KB

MD5
ff74d95317a7da2eccfe1d2521e0238d

SHA1
4b18b8abda54e69809c78ed27555ba8d340ba3ac

SHA256
e9b2989fe1aca63a06df7191b5846e5aa65ebc276914e5671fbc04bb10cfcc96

SHA512
cfb67e6101a34bed170bb01fe6e369445081121230e22ab5dcf3116e898cf416b5766323e72d2cf915aacfc3efd4f2ba0736d83d8ed6755352cef794fd13d651

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe

Filesize
184KB

MD5
17c324d112a9ef5d996abee01f593f1f

SHA1
648a3f4bf3941dcb451c443331555b3a54e8a077

SHA256
c27ab4e6d9b10a3a04e053a7fb3e41697d884228dff3411ed8abc42a647015d6

SHA512
b86256837509bf9979eae7de0a2f57a65b1ab47103a980f62ab08035f6610ae75bff4bf7c4067b7c85663aec8c6d8d3fc8c9f2dc2bec161c5d81d9f103ba2a8c

Download Submit