6d0cafa10e51055215ea601947cb5bf5472ba6c96241f068afbc34d6a9db494a

Analysis

max time kernel
150s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe
Size 184KB
Sample240613-maydbsvaqb
SHA256 6d0cafa10e51055215ea601947cb5bf5472ba6c96241f068afbc34d6a9db494a
MD5 7398f82eb7b42ec50c23d9cc09205780
SHA1 1aa327ae0940f37635c137c148109d2b2204a70d
SHA512 d1fe71182bed7e8a626758b9678e58f72fabeb04266c8bac044a4336575a81ca479a7cb2bc1db182169c0e89a3ab8eda980e72e2512d802ad2d7975d59577686
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9mlvnqnviu:/p0oKOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1088	UnicorÏ-50978.exe
2556	UnicorÏ-20418.exe
4816	UnicorÏ-41584.exe
4448	UnicorÏ-34842.exe
400	UnicorÏ-23144.exe
5060	UnicorÏ-18506.exe
2656	UnicorÏ-12375.exe
2436	UnicorÏ-13793.exe
2156	UnicorÏ-43128.exe
532	UnicorÏ-42382.exe
2288	UnicorÏ-23999.exe
3724	UnicorÏ-30130.exe
4796	UnicorÏ-50285.exe
2208	UnicorÏ-30684.exe
4100	UnicorÏ-49325.exe
3016	UnicorÏ-19990.exe
1112	UnicorÏ-61385.exe
3964	UnicorÏ-7353.exe
1708	UnicorÏ-46340.exe
3120	UnicorÏ-64722.exe
2856	UnicorÏ-13492.exe
2104	UnicorÏ-17022.exe
2116	UnicorÏ-17022.exe
1640	UnicorÏ-57862.exe
2624	UnicorÏ-59900.exe
1764	UnicorÏ-493.exe
2868	UnicorÏ-61184.exe
3464	UnicorÏ-21660.exe
1608	UnicorÏ-41261.exe
2360	UnicorÏ-26342.exe
1624	UnicorÏ-32463.exe
1852	UnicorÏ-54930.exe
3324	UnicorÏ-10368.exe
3268	UnicorÏ-22066.exe
4256	UnicorÏ-56776.exe
3532	UnicorÏ-18750.exe
3616	UnicorÏ-47893.exe
4080	UnicorÏ-60934.exe
2108	UnicorÏ-7384.exe
4400	UnicorÏ-56850.exe
5036	UnicorÏ-20456.exe
4552	UnicorÏ-15818.exe
2256	UnicorÏ-62780.exe
4556	UnicorÏ-56658.exe
2496	UnicorÏ-29915.exe
4328	UnicorÏ-15626.exe
4344	UnicorÏ-60550.exe
3832	UnicorÏ-59788.exe
1416	UnicorÏ-48853.exe
928	UnicorÏ-52937.exe
4436	UnicorÏ-48298.exe
2724	UnicorÏ-22832.exe
4808	UnicorÏ-28432.exe
5040	UnicorÏ-56466.exe
2884	UnicorÏ-35589.exe
4484	UnicorÏ-15988.exe
3708	UnicorÏ-53150.exe
2080	UnicorÏ-16756.exe
2004	UnicorÏ-36622.exe
4040	UnicorÏ-20020.exe
4960	UnicorÏ-54302.exe
4072	UnicorÏ-27559.exe
4944	UnicorÏ-41858.exe
2448	UnicorÏ-63025.exe

Program crash 9 IoCs

pid	pid_target	Process	procid_target
6764	1092	WerFault.exe	179
11508	12860	WerFault.exe	596
12460	12872	WerFault.exe	597
12420	12908	WerFault.exe	600
12528	12880	WerFault.exe	598
15448	16208	WerFault.exe	796
15472	16216	WerFault.exe	797
15456	16224	WerFault.exe	798
14936	7320	Process not Found	1117

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4516	dwm.exe
Token: SeChangeNotifyPrivilege	4516	dwm.exe
Token: 33	4516	dwm.exe
Token: SeIncBasePriorityPrivilege	4516	dwm.exe
Token: SeCreateGlobalPrivilege	9108	Process not Found
Token: SeChangeNotifyPrivilege	9108	Process not Found
Token: 33	9108	Process not Found
Token: SeIncBasePriorityPrivilege	9108	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe
1088	UnicorÏ-50978.exe
2556	UnicorÏ-20418.exe
4816	UnicorÏ-41584.exe
4448	UnicorÏ-34842.exe
400	UnicorÏ-23144.exe
5060	UnicorÏ-18506.exe
2656	UnicorÏ-12375.exe
2436	UnicorÏ-13793.exe
2156	UnicorÏ-43128.exe
532	UnicorÏ-42382.exe
2288	UnicorÏ-23999.exe
3724	UnicorÏ-30130.exe
2208	UnicorÏ-30684.exe
4796	UnicorÏ-50285.exe
4100	UnicorÏ-49325.exe
3016	UnicorÏ-19990.exe
1112	UnicorÏ-61385.exe
3964	UnicorÏ-7353.exe
1708	UnicorÏ-46340.exe
3120	UnicorÏ-64722.exe
2856	UnicorÏ-13492.exe
2104	UnicorÏ-17022.exe
2116	UnicorÏ-17022.exe
1764	UnicorÏ-493.exe
3464	UnicorÏ-21660.exe
1608	UnicorÏ-41261.exe
2624	UnicorÏ-59900.exe
2868	UnicorÏ-61184.exe
1640	UnicorÏ-57862.exe
2360	UnicorÏ-26342.exe
1624	UnicorÏ-32463.exe
1852	UnicorÏ-54930.exe
3324	UnicorÏ-10368.exe
3268	UnicorÏ-22066.exe
4256	UnicorÏ-56776.exe
3532	UnicorÏ-18750.exe
3616	UnicorÏ-47893.exe
4080	UnicorÏ-60934.exe
2108	UnicorÏ-7384.exe
4400	UnicorÏ-56850.exe
5036	UnicorÏ-20456.exe
4552	UnicorÏ-15818.exe
2256	UnicorÏ-62780.exe
4556	UnicorÏ-56658.exe
2496	UnicorÏ-29915.exe
4328	UnicorÏ-15626.exe
4344	UnicorÏ-60550.exe
2724	UnicorÏ-22832.exe
928	UnicorÏ-52937.exe
1416	UnicorÏ-48853.exe
3832	UnicorÏ-59788.exe
4436	UnicorÏ-48298.exe
2884	UnicorÏ-35589.exe
5040	UnicorÏ-56466.exe
4484	UnicorÏ-15988.exe
4808	UnicorÏ-28432.exe
3708	UnicorÏ-53150.exe
2004	UnicorÏ-36622.exe
4040	UnicorÏ-20020.exe
2080	UnicorÏ-16756.exe
4960	UnicorÏ-54302.exe
3420	UnicorÏ-50581.exe
4072	UnicorÏ-27559.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1088	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	81
PID 4456 wrote to memory of 1088	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	81
PID 4456 wrote to memory of 1088	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	81
PID 1088 wrote to memory of 2556	1088	UnicorÏ-50978.exe	82
PID 1088 wrote to memory of 2556	1088	UnicorÏ-50978.exe	82
PID 1088 wrote to memory of 2556	1088	UnicorÏ-50978.exe	82
PID 4456 wrote to memory of 4816	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	83
PID 4456 wrote to memory of 4816	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	83
PID 4456 wrote to memory of 4816	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	83
PID 2556 wrote to memory of 4448	2556	UnicorÏ-20418.exe	84
PID 2556 wrote to memory of 4448	2556	UnicorÏ-20418.exe	84
PID 2556 wrote to memory of 4448	2556	UnicorÏ-20418.exe	84
PID 1088 wrote to memory of 400	1088	UnicorÏ-50978.exe	85
PID 1088 wrote to memory of 400	1088	UnicorÏ-50978.exe	85
PID 1088 wrote to memory of 400	1088	UnicorÏ-50978.exe	85
PID 4816 wrote to memory of 5060	4816	UnicorÏ-41584.exe	86
PID 4816 wrote to memory of 5060	4816	UnicorÏ-41584.exe	86
PID 4816 wrote to memory of 5060	4816	UnicorÏ-41584.exe	86
PID 4456 wrote to memory of 2656	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	87
PID 4456 wrote to memory of 2656	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	87
PID 4456 wrote to memory of 2656	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	87
PID 4448 wrote to memory of 2436	4448	UnicorÏ-34842.exe	88
PID 4448 wrote to memory of 2436	4448	UnicorÏ-34842.exe	88
PID 4448 wrote to memory of 2436	4448	UnicorÏ-34842.exe	88
PID 2556 wrote to memory of 2156	2556	UnicorÏ-20418.exe	89
PID 2556 wrote to memory of 2156	2556	UnicorÏ-20418.exe	89
PID 2556 wrote to memory of 2156	2556	UnicorÏ-20418.exe	89
PID 400 wrote to memory of 532	400	UnicorÏ-23144.exe	90
PID 400 wrote to memory of 532	400	UnicorÏ-23144.exe	90
PID 400 wrote to memory of 532	400	UnicorÏ-23144.exe	90
PID 1088 wrote to memory of 2288	1088	UnicorÏ-50978.exe	91
PID 1088 wrote to memory of 2288	1088	UnicorÏ-50978.exe	91
PID 1088 wrote to memory of 2288	1088	UnicorÏ-50978.exe	91
PID 2656 wrote to memory of 3724	2656	UnicorÏ-12375.exe	92
PID 2656 wrote to memory of 3724	2656	UnicorÏ-12375.exe	92
PID 2656 wrote to memory of 3724	2656	UnicorÏ-12375.exe	92
PID 4456 wrote to memory of 4796	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	93
PID 4456 wrote to memory of 4796	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	93
PID 4456 wrote to memory of 4796	4456	7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe	93
PID 4816 wrote to memory of 2208	4816	UnicorÏ-41584.exe	94
PID 4816 wrote to memory of 2208	4816	UnicorÏ-41584.exe	94
PID 4816 wrote to memory of 2208	4816	UnicorÏ-41584.exe	94
PID 5060 wrote to memory of 4100	5060	UnicorÏ-18506.exe	95
PID 5060 wrote to memory of 4100	5060	UnicorÏ-18506.exe	95
PID 5060 wrote to memory of 4100	5060	UnicorÏ-18506.exe	95
PID 2436 wrote to memory of 3016	2436	UnicorÏ-13793.exe	96
PID 2436 wrote to memory of 3016	2436	UnicorÏ-13793.exe	96
PID 2436 wrote to memory of 3016	2436	UnicorÏ-13793.exe	96
PID 4448 wrote to memory of 1112	4448	UnicorÏ-34842.exe	97
PID 4448 wrote to memory of 1112	4448	UnicorÏ-34842.exe	97
PID 4448 wrote to memory of 1112	4448	UnicorÏ-34842.exe	97
PID 2156 wrote to memory of 3964	2156	UnicorÏ-43128.exe	98
PID 2156 wrote to memory of 3964	2156	UnicorÏ-43128.exe	98
PID 2156 wrote to memory of 3964	2156	UnicorÏ-43128.exe	98
PID 2556 wrote to memory of 1708	2556	UnicorÏ-20418.exe	99
PID 2556 wrote to memory of 1708	2556	UnicorÏ-20418.exe	99
PID 2556 wrote to memory of 1708	2556	UnicorÏ-20418.exe	99
PID 532 wrote to memory of 3120	532	UnicorÏ-42382.exe	100
PID 532 wrote to memory of 3120	532	UnicorÏ-42382.exe	100
PID 532 wrote to memory of 3120	532	UnicorÏ-42382.exe	100
PID 400 wrote to memory of 2856	400	UnicorÏ-23144.exe	101
PID 400 wrote to memory of 2856	400	UnicorÏ-23144.exe	101
PID 400 wrote to memory of 2856	400	UnicorÏ-23144.exe	101
PID 2208 wrote to memory of 2104	2208	UnicorÏ-30684.exe	102

C:\Users\Admin\AppData\Local\Temp\7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7398f82eb7b42ec50c23d9cc09205780_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50978.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50978.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20418.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34842.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13793.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19990.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19990.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54930.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54930.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41858.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41858.exe
        8⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-161.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-161.exe
        9⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57966.exe
        10⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32636.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32636.exe
        10⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24379.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24379.exe
        10⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        10⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50026.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50026.exe
        10⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28116.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28116.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52952.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52952.exe
        9⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40525.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40525.exe
        9⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        9⤵
        
        PID:18016
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3750.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3750.exe
        9⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14312.exe
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65366.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65366.exe
        9⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24978.exe
        10⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56729.exe
        10⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40627.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40627.exe
        10⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52097.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52097.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31779.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31779.exe
        9⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64409.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64409.exe
        9⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51697.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51697.exe
        9⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46320.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46320.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8464.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8464.exe
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22923.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22923.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51181.exe
        8⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19938.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19938.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63025.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63025.exe
        7⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65470.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65470.exe
        9⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27399.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27399.exe
        9⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59033.exe
        9⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13227.exe
        9⤵
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13307.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13307.exe
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23884.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23884.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7069.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7069.exe
        8⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27855.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27855.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        8⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65018.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65018.exe
        8⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5367.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61157.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61157.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15293.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15293.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13571.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13571.exe
        7⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10368.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10368.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54302.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54302.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45278.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45278.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        9⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46040.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46040.exe
        9⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        9⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7649.exe
        9⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        8⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58728.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58728.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-968.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50772.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15834.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        8⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12880 -s 176
        9⤵
        Program crash
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19667.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19408.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19408.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64812.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64812.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63269.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63269.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37826.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37826.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30312.exe
        7⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27559.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27559.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53830.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53830.exe
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53550.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53550.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10509.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10509.exe
        9⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13768.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13768.exe
        9⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        9⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42163.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42163.exe
        9⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32340.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32340.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36336.exe
        8⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61311.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61311.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7400.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7400.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3995.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3995.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37069.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39216.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39216.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46357.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46357.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12931.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12931.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5164.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5164.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7119.exe
        7⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23675.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1676.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1676.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24797.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24797.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27447.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27447.exe
        6⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40218.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40218.exe
        6⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61385.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61385.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22066.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21438.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21438.exe
        7⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45714.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32636.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32636.exe
        9⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24379.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24379.exe
        9⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        9⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39637.exe
        9⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13307.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13307.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23884.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23884.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28065.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28065.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17907.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17907.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18574.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18574.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53168.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53168.exe
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13340.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13340.exe
        8⤵
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50789.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50789.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60972.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51129.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31080.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31080.exe
        7⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50581.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31734.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31734.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32252.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26543.exe
        8⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15784.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        8⤵
        
        PID:18196
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14172.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63284.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63284.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63685.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53352.exe
        7⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45742.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45742.exe
        7⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44384.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16846.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16846.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32356.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27835.exe
        7⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41737.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41737.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5367.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5367.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49672.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49672.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32590.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32590.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4827.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4827.exe
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58417.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58417.exe
        6⤵
        
        PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56776.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56776.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25522.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25522.exe
        6⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41194.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9725.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9725.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33596.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33596.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45952.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45952.exe
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13200.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13200.exe
        8⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50368.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50368.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42000.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42000.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34732.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        7⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12908 -s 176
        8⤵
        Program crash
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19667.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19667.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47897.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47897.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26475.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26877.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26877.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53048.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53048.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        6⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4644.exe
        5⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45278.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45278.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23374.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23374.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64157.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10783.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10783.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47881.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47881.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20285.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20285.exe
        7⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13020.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13020.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2393.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40968.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40968.exe
        7⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60746.exe
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62132.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62132.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21500.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7119.exe
        6⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17694.exe
        6⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41584.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41584.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10405.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10405.exe
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37016.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37016.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62541.exe
        6⤵
        
        PID:18228
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15433.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15433.exe
        6⤵
        
        PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7140.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7140.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47522.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47522.exe
        5⤵
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48575.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48575.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38640.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38640.exe
        5⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38606.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38606.exe
        5⤵
        
        PID:228
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43128.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7353.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18750.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34650.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34650.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30862.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30862.exe
        8⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21018.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21018.exe
        9⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63986.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63986.exe
        10⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22320.exe
        10⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50376.exe
        10⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28951.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28951.exe
        10⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44889.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44889.exe
        9⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8043.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8043.exe
        9⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57357.exe
        9⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16719.exe
        8⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64785.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50368.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50368.exe
        8⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62229.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62229.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45704.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45704.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3404.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3404.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46040.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46040.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50045.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50045.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31711.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31711.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36197.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36197.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58728.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58728.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53677.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16731.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16731.exe
        7⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59901.exe
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33986.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33986.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22658.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22658.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60358.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12740.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45708.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45708.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16788.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64976.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64976.exe
        7⤵
        
        PID:18152
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15411.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41210.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41210.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19964.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19964.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7143.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7143.exe
        7⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5406.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5406.exe
        7⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60929.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5959.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5959.exe
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36512.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48978.exe
        6⤵
        
        PID:18420
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26482.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51388.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51388.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7440.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7440.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-680.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-680.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48484.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        7⤵
        
        PID:18000
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30648.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4017.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4017.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31972.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28473.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28473.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11918.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26475.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32767.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32767.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29748.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9673.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9673.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63945.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65276.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65276.exe
        5⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58542.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49549.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49549.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45568.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45568.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10076.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10076.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26903.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26903.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49540.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
        6⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50249.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17312.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23675.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1676.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1676.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4569.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43975.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43975.exe
        5⤵
        
        PID:18144
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46340.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2709.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2709.exe
        6⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1588.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1625.exe
        8⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36116.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36116.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16567.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16567.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9682.exe
        8⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        7⤵
        
        PID:16216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16216 -s 180
        8⤵
        Program crash
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32492.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32492.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51173.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51173.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21662.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41972.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54076.exe
        7⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58691.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58691.exe
        7⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45692.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45692.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        6⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22699.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22699.exe
        6⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35744.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35744.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44858.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44858.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31972.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10923.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10923.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        7⤵
        
        PID:18160
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-539.exe
        6⤵
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36614.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32043.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32043.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38102.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5852.exe
        6⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2356.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2356.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45596.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11248.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11248.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64650.exe
        5⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1169.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1169.exe
        5⤵
        
        PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7384.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31298.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31298.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55558.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55558.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44946.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44946.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11329.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11329.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55141.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55141.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2857.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2857.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31868.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31868.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64645.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64645.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1027.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1027.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39304.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39304.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56041.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56041.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49732.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49732.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16536.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16536.exe
        6⤵
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2828.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2828.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16270.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16270.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        6⤵
        
        PID:18240
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48490.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48490.exe
        6⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63040.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63040.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1988.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44880.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        5⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44744.exe
        5⤵
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46680.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46680.exe
      4⤵
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63041.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63041.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44422.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44422.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43220.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43220.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        5⤵
        
        PID:16208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16208 -s 212
        6⤵
        Program crash
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6552.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6552.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60888.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60888.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27700.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27700.exe
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58484.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58484.exe
        5⤵
        
        PID:13012
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49085.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49085.exe
        5⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43822.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51782.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51782.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45207.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45207.exe
      4⤵
      PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5724.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5724.exe
      4⤵
      PID:15848
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23144.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42382.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56850.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56850.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54769.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56238.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56238.exe
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32252.exe
        8⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26543.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15784.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52412.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52412.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3612.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3612.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42768.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42768.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50413.exe
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61272.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61272.exe
        7⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43913.exe
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31438.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31438.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65470.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65470.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48309.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        8⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43822.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43822.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60824.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60824.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13340.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13340.exe
        7⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        7⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47473.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47473.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9031.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9031.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17121.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17121.exe
        6⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31298.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31298.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47966.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47966.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11853.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11853.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38272.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21972.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40420.exe
        7⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49596.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49596.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29600.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13228.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13228.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        7⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12117.exe
        7⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58520.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58520.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34033.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47052.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47584.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47584.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34028.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34028.exe
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57648.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57648.exe
        5⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15834.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15834.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44565.exe
        7⤵
        
        PID:17160
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40706.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40706.exe
        7⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17976.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17976.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30331.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30331.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1856.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1856.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4675.exe
        6⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        6⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8168.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8168.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1817.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1817.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29484.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29484.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3486.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3486.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10411.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10411.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41504.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32590.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32590.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55402.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55402.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13492.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15818.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15818.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54769.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54769.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7037.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7037.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9321.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9321.exe
        8⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44809.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10872.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10872.exe
        7⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10783.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10783.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6848.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6848.exe
        7⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60358.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26755.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26755.exe
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2460.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62036.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62036.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56121.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56121.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55868.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55868.exe
        5⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18906.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18906.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5001.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5001.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8068.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8068.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26785.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26785.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59584.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59584.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51817.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15618.exe
        6⤵
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12776.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12776.exe
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39488.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33824.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33824.exe
        5⤵
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28802.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28802.exe
        5⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64713.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64713.exe
        5⤵
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62780.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31106.exe
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        7⤵
        
        PID:18248
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44790.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44790.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15426.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15426.exe
        6⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1972.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1972.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60582.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60582.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38796.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-767.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-767.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64236.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64236.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46224.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46224.exe
        5⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22315.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22315.exe
        5⤵
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63513.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63513.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18294.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17468.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-983.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35324.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26057.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26057.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40420.exe
        5⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28600.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28600.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58024.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58024.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63306.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63306.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10348.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49852.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49852.exe
        5⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59381.exe
        5⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16201.exe
        5⤵
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1852.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1852.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58570.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58570.exe
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11059.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11059.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55134.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55134.exe
      4⤵
      PID:1056
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23999.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23999.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-493.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28432.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16306.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16306.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6653.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6653.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10509.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10509.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18044.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58544.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31292.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31292.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31203.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31203.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47881.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47881.exe
        6⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29932.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29932.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1255.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1255.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1656.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28271.exe
        5⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24170.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24170.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54716.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54716.exe
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12273.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12273.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21382.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21382.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44809.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3817.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64733.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64836.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        5⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7834.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7834.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2024.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2024.exe
      4⤵
      PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45300.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45300.exe
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51889.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51889.exe
      4⤵
      PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1557.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1557.exe
      4⤵
      PID:17492
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41261.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63601.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63601.exe
      4⤵
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-649.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-649.exe
        5⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40530.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40530.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14816.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48649.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48649.exe
        6⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14047.exe
        6⤵
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58535.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43440.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43440.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32251.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32251.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-907.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-907.exe
      4⤵
      PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30473.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30473.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56992.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56992.exe
      4⤵
      PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47184.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47184.exe
      4⤵
      PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10063.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10063.exe
      4⤵
      PID:10168
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59788.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59788.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47824.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47824.exe
    3⤵
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
      4⤵
      PID:12860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12860 -s 244
        5⤵
        Program crash
        
        PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8819.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8819.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53233.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53233.exe
      4⤵
      PID:8156
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34730.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34730.exe
    3⤵
    PID:7312
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44719.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44719.exe
    3⤵
    PID:11048
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38004.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38004.exe
    3⤵
    PID:13724
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44236.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44236.exe
    3⤵
    PID:17456
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41584.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41584.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18506.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49325.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49325.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26342.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53150.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12221.exe
        7⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49450.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49450.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3228.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3228.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19319.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19319.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17171.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17171.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32812.exe
        6⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14489.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14489.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20488.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        7⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44982.exe
        7⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37000.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37000.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53965.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53965.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64340.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64340.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49836.exe
        6⤵
        
        PID:17544
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53104.exe
        6⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16756.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60846.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60846.exe
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12273.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12273.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51734.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51734.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46825.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50376.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52392.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56241.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56241.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28645.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28645.exe
        7⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47961.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47961.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23369.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23369.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8891.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8891.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16536.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16536.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27471.exe
        5⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28610.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28610.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10073.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33560.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33560.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33183.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7467.exe
        6⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52009.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52009.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6263.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54193.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54193.exe
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56592.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56592.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42760.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4873.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4873.exe
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32463.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48786.exe
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33322.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27422.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27422.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51101.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51101.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9919.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9919.exe
        8⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61239.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18744.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18744.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28167.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28167.exe
        7⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55717.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50716.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50716.exe
        7⤵
        
        PID:17660
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16002.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56793.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56793.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29358.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36640.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36640.exe
        7⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47590.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47590.exe
        7⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24607.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24607.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16648.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39216.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-39216.exe
        6⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23101.exe
        6⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13544.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13544.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12931.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12931.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55980.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55980.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9188.exe
        6⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52611.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52611.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33875.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33875.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63093.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63093.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44496.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44496.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17740.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17740.exe
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20020.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44894.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9533.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9533.exe
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53825.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53825.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13008.exe
        6⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44214.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44214.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3228.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3228.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55116.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63685.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53352.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7834.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7834.exe
        5⤵
        
        PID:18136
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6991.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6991.exe
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2569.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62694.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62694.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16848.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33035.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33035.exe
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59584.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59584.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51817.exe
        5⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        5⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17694.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53113.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53113.exe
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40018.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40018.exe
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29359.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29359.exe
      4⤵
      PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1936.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1936.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30684.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30684.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17022.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63601.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63601.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37110.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        7⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24369.exe
        7⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41189.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26903.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26903.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49540.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44384.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44384.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12569.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65029.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31919.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31919.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49329.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49329.exe
        6⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32341.exe
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18211.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18211.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53041.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53041.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65506.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65506.exe
        5⤵
        
        PID:18100
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52937.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52937.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9844.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9844.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57686.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57686.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65029.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27835.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41545.exe
        6⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14031.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26877.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26877.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4039.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48440.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48440.exe
        5⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
        5⤵
        
        PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1623.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1623.exe
      4⤵
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9533.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9533.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-207.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-207.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53545.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53545.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64976.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64976.exe
        5⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50019.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42865.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42865.exe
      4⤵
      PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-183.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-183.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51889.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51889.exe
      4⤵
      PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26254.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26254.exe
      4⤵
      PID:1704
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59900.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59900.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56466.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60078.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60078.exe
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56134.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56134.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35118.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35118.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33944.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2239.exe
        7⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61898.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61898.exe
        7⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35569.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-539.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-539.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61119.exe
        6⤵
        
        PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-33300.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13228.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13228.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62376.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13288.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65018.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65018.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25463.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1168.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1168.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25028.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25028.exe
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2237.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61521.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54513.exe
        5⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28069.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28069.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16963.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16963.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60981.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60981.exe
      4⤵
      PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55020.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55020.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36816.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36816.exe
      4⤵
      PID:17236
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35589.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9844.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9844.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53882.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53882.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28640.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28640.exe
        6⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53057.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53057.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53160.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53160.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36937.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36937.exe
        5⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28453.exe
        5⤵
        
        PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62656.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62656.exe
      4⤵
      PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63093.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63093.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44496.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44496.exe
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13848.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13848.exe
      4⤵
      PID:17764
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1547.exe
      4⤵
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60468.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60468.exe
    3⤵
    PID:1092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 720
      4⤵
      Program crash
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-456.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-456.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1329.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1329.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9824.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9824.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29867.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29867.exe
      4⤵
      PID:17976
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9682.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9682.exe
      4⤵
      PID:7244
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27086.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27086.exe
    3⤵
    PID:8896
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4175.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4175.exe
    3⤵
    PID:12296
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5724.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5724.exe
    3⤵
    PID:15812
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35951.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35951.exe
    3⤵
    PID:2112
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12375.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12375.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30130.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57862.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15345.exe
        6⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53550.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53550.exe
        7⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43078.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43078.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14432.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14432.exe
        8⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49852.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49852.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31961.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32340.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32340.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64733.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64733.exe
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46424.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46424.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65203.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65203.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64961.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64961.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20790.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32216.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32216.exe
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7143.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7143.exe
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52044.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52044.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60457.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60457.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41956.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41956.exe
        6⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35545.exe
        6⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49533.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49533.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35818.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35818.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29269.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35559.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35559.exe
        7⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49836.exe
        7⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44744.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37000.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37000.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24851.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24851.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60569.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60569.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28830.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48328.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48328.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65257.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65257.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59296.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59296.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53345.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53345.exe
        5⤵
        
        PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30484.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30484.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15988.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15988.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12221.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12221.exe
        5⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61282.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61282.exe
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27784.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64836.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52777.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        6⤵
        
        PID:17988
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23351.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23351.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46913.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46913.exe
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44880.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44880.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31912.exe
        5⤵
        
        PID:18348
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41859.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41859.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27471.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27471.exe
      4⤵
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45190.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45190.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32710.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11308.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11308.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23567.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16004.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16004.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11831.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11831.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40725.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-40725.exe
        5⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15426.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15426.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22533.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22533.exe
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42228.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42228.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56985.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56985.exe
      4⤵
      PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64250.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64250.exe
      4⤵
      PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45901.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45901.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21660.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56658.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14577.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14577.exe
        5⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31438.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31438.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20354.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20354.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        7⤵
        
        PID:18288
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31239.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2704.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2704.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4623.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35161.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35161.exe
        6⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43004.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43004.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1765.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1765.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54225.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29571.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29571.exe
        6⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50523.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29321.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23203.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23203.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29888.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29888.exe
        5⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9715.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9715.exe
        5⤵
        
        PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19216.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19216.exe
      4⤵
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23270.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21890.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21890.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12896.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12896.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61528.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62541.exe
        6⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16201.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31188.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31188.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63772.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10792.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-10792.exe
        5⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5791.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5791.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25130.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25130.exe
        5⤵
        
        PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47036.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47036.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14949.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14949.exe
        5⤵
        
        PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31329.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31329.exe
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-671.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-671.exe
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
      4⤵
      PID:15948
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29915.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63778.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63778.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1588.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4121.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4121.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3332.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36012.exe
        6⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43087.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43087.exe
        6⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22339.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30717.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51904.exe
        5⤵
        
        PID:16224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16224 -s 176
        6⤵
        Program crash
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49980.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49980.exe
        5⤵
        
        PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6056.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6056.exe
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41608.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41608.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
      4⤵
      PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26565.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26565.exe
    3⤵
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42133.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42133.exe
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48616.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48616.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26616.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26616.exe
      4⤵
      PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5065.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-5065.exe
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16991.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16991.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56306.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56306.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14100.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14100.exe
      4⤵
      PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54938.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54938.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46968.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46968.exe
    3⤵
    PID:8800
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43235.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43235.exe
    3⤵
    PID:13188
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20088.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20088.exe
    3⤵
    PID:16532
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2234.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2234.exe
    3⤵
    PID:6860
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50285.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50285.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17022.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15626.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15626.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63394.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63394.exe
        5⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27354.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13617.exe
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45657.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3331.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3331.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41712.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41712.exe
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52568.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52568.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29425.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27067.exe
        6⤵
        
        PID:18008
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59341.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59341.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56498.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-56498.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63493.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49994.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49994.exe
        6⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54052.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54052.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17696.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32059.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12647.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12647.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53233.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-53233.exe
      4⤵
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63041.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63041.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29290.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29290.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20296.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-24327.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11996.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11996.exe
        6⤵
        
        PID:18380
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25463.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64236.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64236.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25612.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25612.exe
        5⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43120.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43120.exe
        5⤵
        
        PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51120.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51120.exe
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18678.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18678.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46144.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46144.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14928.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-14928.exe
        5⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19216.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19216.exe
        5⤵
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31329.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31329.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62124.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62124.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-15524.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36425.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-36425.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48853.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32258.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32258.exe
      4⤵
      PID:804
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61386.exe
        5⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-44225.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6839.exe
        5⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        5⤵
        
        PID:18188
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23264.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23264.exe
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48100.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48100.exe
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7468.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7468.exe
      4⤵
      PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25723.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25723.exe
      4⤵
      PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12494.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12494.exe
      4⤵
      PID:10852
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27279.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27279.exe
    3⤵
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65366.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65366.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65330.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65330.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11220.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-11220.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4211.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-4211.exe
        5⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31868.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31868.exe
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64645.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64645.exe
      4⤵
      PID:14080
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28212.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28212.exe
      4⤵
      PID:17916
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23597.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23597.exe
    3⤵
    PID:7452
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28387.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-28387.exe
    3⤵
    PID:10312
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55589.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-55589.exe
    3⤵
    PID:14532
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6793.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-6793.exe
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31573.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31573.exe
    3⤵
    PID:4644
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61184.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61184.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60550.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31490.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-31490.exe
      4⤵
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35988.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48330.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48330.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38796.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-35872.exe
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-48302.exe
        6⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45028.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45028.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-37069.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63720.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63720.exe
        5⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2873.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-2873.exe
        5⤵
        
        PID:972
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63233.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63233.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47376.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8500.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8500.exe
        5⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-29518.exe
        5⤵
        
        PID:17744
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62028.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62028.exe
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54261.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54261.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27783.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27783.exe
      4⤵
      PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16731.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16731.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57701.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57701.exe
    3⤵
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3913.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-3913.exe
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52097.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-52097.exe
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27503.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-27503.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64409.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64409.exe
      4⤵
      PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
      4⤵
      PID:5708
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57612.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57612.exe
    3⤵
    PID:7236
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25377.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25377.exe
    3⤵
    PID:11028
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9711.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-9711.exe
    3⤵
    PID:14324
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58581.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58581.exe
    3⤵
    PID:2968
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22832.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-22832.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23322.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23322.exe
    3⤵
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13543.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13543.exe
      4⤵
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19918.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-51573.exe
        5⤵
        
        PID:12872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12872 -s 176
        6⤵
        Program crash
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47680.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47680.exe
        5⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\UnicorÏ-8104.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50701.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50701.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65160.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-65160.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63329.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-63329.exe
      4⤵
      PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62808.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62808.exe
      4⤵
      PID:7348
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25516.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-25516.exe
    3⤵
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60435.exe
      C:\Users\Admin\AppData\Local\Temp\UnicorÏ-60435.exe
      4⤵
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58520.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-58520.exe
    3⤵
    PID:8528
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38117.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-38117.exe
    3⤵
    PID:12072
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47052.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-47052.exe
    3⤵
    PID:15568
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20815.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20815.exe
    3⤵
    PID:17588
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64890.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64890.exe
  2⤵
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13617.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13617.exe
    3⤵
    PID:6412
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45657.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-45657.exe
    3⤵
    PID:10740
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-62096.exe
    3⤵
    PID:13788
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13008.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13008.exe
    3⤵
    PID:17088
- - C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
    C:\Users\Admin\AppData\Local\Temp\UnicorÏ-1017.exe
    3⤵
    PID:5792
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13199.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13199.exe
  2⤵
  PID:7324
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18964.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18964.exe
  2⤵
  PID:11096
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42204.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42204.exe
  2⤵
  PID:13976
- C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41389.exe
  C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41389.exe
  2⤵
  PID:16720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1092 -ip 1092
1⤵
PID:6724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 12860 -ip 12860
1⤵
PID:13040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12880 -ip 12880
1⤵
PID:13152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12908 -ip 12908
1⤵
PID:13240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 12872 -ip 12872
1⤵
PID:12204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 16208 -ip 16208
1⤵
PID:16284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 16216 -ip 16216
1⤵
PID:16308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 16224 -ip 16224
1⤵
PID:16352

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UnicorÏ-12375.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-12375.exe
Size 184KB
SHA256 c4863fe18d9be10e5fc48e584092c40014782f33e24c0b1b9ca8a9ebf535549b
MD5 c4f93d1f607d0b59daee149682255b8f
SHA1 16467264cacf7ab2af2066fa248402cf21c3fb9d
SHA512 61f1e5db79f2b6629cf332c43004305c31610a716955e00fd09d074f23575e3e5b0c0de690288d6cc0fafa1aad86d9ec935bbc8c4bb89ec6bc878981238b9789
SSDEEP 3072:npvJghoVpPwNidvxTZZGovA9mlvnqnviu:np0oKOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-13492.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13492.exe
Size 184KB
SHA256 9aab1ded4d4b1f5ef1bdf87126bfe19b66abb20449e3b83940adf2232b726826
MD5 a9224f5809bc19dacf2d86ff28094530
SHA1 942269ac3d948c7cfc8a437e522334f59cb7206a
SHA512 46ff7ed83a6d5aa04a8e2a65c5d98a6805e71bfd4bf8cf310821b252ef95ca8c392b662121801cde6924d56e7a2ecc9922aa60bac1f068f66230f91251052f9e
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9elvnqnviu:/p0oKOvxeoo9elPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-13793.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-13793.exe
Size 184KB
SHA256 b6d8782aad319cb6e433bdef96730879a7ac182f5356ce801de466c0a51a6b58
MD5 a9df94c6104d203da742c3b6512186e1
SHA1 ee32ddcbe751b2a1f1353204cdfb3601b5c2c002
SHA512 817c11865a17e4632c48496987c38cdf66505fe771626534a8f2ea7b310a6176bc4bab646064db599858d0239cc1a992879a5869db43f48326543a38de3035a4
SSDEEP 3072:/pvJChoVpPwvidvxTZZGovA9xlvnqnviu:/paoEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-16848.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-16848.exe
Size 184KB
SHA256 dca3e65baf090f246ba6feb551071e0bf61b9c14a9d970a8bfe9ff2d0e33ccc0
MD5 7746f5505aa5a3d44bf21dc2b9234e12
SHA1 6856c9cb387ce8df3160ecf0e4fad086153b1f76
SHA512 5a7c2acffe6b4c240827114dff17e3401d29507872f0f7354e6c2713d74ac1ceeb1f27605ac86117f85d6184a17bc54408fd56e0880247b976d1756e0e83096d
SSDEEP 3072:dp3NghoVpPONidvxTZZGovA9mlvnqnviu:dpAoQOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-17022.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-17022.exe
Size 184KB
SHA256 6b8772ccc0de332d2375fce126f61d7ae9f058ca02c75d600061701b66e09f99
MD5 e12bd84063ed5180ddb3fce3ed43d2dd
SHA1 621726fbcf51566f1419dfecd4ad2e5e689ad363
SHA512 efbbf091e16461464beab19b404385713d8c6e206e6c90c977b87b9afed8482796743633f0a309532ddf09a60886d1c0a3278e878700c07e5dea8569685beebf
SSDEEP 3072:/pvJghoVpNwNidvxTZZGovA9mlvnqnviu:/p0oUOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-18506.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-18506.exe
Size 184KB
SHA256 f8b753186ef484555048ebf5955e40e461d5039ecc8686603685cfca2ad2c554
MD5 29f3ccfd4842e2b237d9d9dfa625f9d1
SHA1 a75b077722ef78ebc104b8bb966903eaf9f3d057
SHA512 f4970433975e44f246e4415f6e29d9886e9f384557ab29f3f22ff14696d448a1baca0d3a437a6258ed4ae40167da375f1067bc134e620d52906b1924011c7e49
SSDEEP 3072:jpvJghoVpPONidvxTZZGovA9mlvnqnviu:jp0oQOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-19990.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-19990.exe
Size 184KB
SHA256 5c4b4e133a6f4e98e50349ca67b66a3319765f3a09fdc7c0e9a023332102d951
MD5 c8c6024c5a682e42a2497603464e15d6
SHA1 1d9bb806e3e64c2e3c27227ea3349ce1d4a78543
SHA512 92d3843ae21f00f3f17d6ab910b7795ce6ffe05686f6c9083569c4f4ef982f5739cad03382236204a5c2f350118d032ea917d2c28ecdab6d4725ff93df33de0f
SSDEEP 3072:/pvJChoVpPwAidvxTZZGovA9xlvnqnviu:/paojOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-20418.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-20418.exe
Size 184KB
SHA256 1aa53578f34c0acb187b7fa7c0dd843b08f42829b038a8727a49d3e6846d4857
MD5 cacedfbe068b82f05d3114b093588d6c
SHA1 3ad63287bac12fa5ec1727e6e1a1192d70985b5d
SHA512 4cdb24fa7742eabf3dcd3f8dc1e0a959d72743b88519714d133f32bb4e7420b8c4ea6fa90a7540939e6984f76ff872de12753afba0304ed2d35b07eac49790c2
SSDEEP 3072:/pvJghoVpPwvidvxTZZGovA9xlvnqnviu:/p0oEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-21660.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-21660.exe
Size 184KB
SHA256 1511d392f46b440fb4cd2782443f52a45e6421fdd3e958e858e55df18eae6723
MD5 8cc0a751efea56c7c5cf59a7d7ee7640
SHA1 9b12381737496ccc743f38bef3bc454c4460088e
SHA512 5aecd2507a2947d25ea3daba8a63c659f3757e6472eb3d2eb2e4e66e3306df862d2b7bd2b6d05ef2ea74e6f004f3a685749a8feeb121d0814dcff9a52c7a0e71
SSDEEP 3072:npvJghoVpPwNidvxTZZGovA9Slvnqnviu:np0oKOvxeoo9SlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-23144.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23144.exe
Size 184KB
SHA256 bee18961bf29f3b726fcdeaee08ac350e30d373c55117d3dc762586e740fefff
MD5 ff15ecea61676cc0e051ee469a18073c
SHA1 9103efb8ce911dc66ac90619861df8487a373d06
SHA512 e0b6202991f32226fbc5629f60ccc8f9e16cfb0f32b1f44516ad5a25ff02c0dad32c848dc59f04360a7f6873bff25ba2769c83fddaa31ad935ca456019ee482f
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9nlvnqnviu:/p0oKOvxeoo9nlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-23999.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-23999.exe
Size 184KB
SHA256 0ecdc860a0c1b4237b9b80758c20238dc8cbb52e9dbbb3a2adc0153f1f585f7d
MD5 965276dff224b58c254cf268c0353be3
SHA1 9616b16eec4e4b8817319cf1b32a77cca056e1cf
SHA512 d76b9f7a723e315e0220cde4c89d5e8dfee8b5a2d910bdace7053981419486ce282b6efda600f9c21370c1aa1d148c45f86214a4f73fa7558fac5d19163fdcd2
SSDEEP 3072:/pvJghoVpVwNidvxTZZGovA9xlvnqnviu:/p0oEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-26342.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-26342.exe
Size 184KB
SHA256 f26dac84f55977b9b89ac8ef2e151c65b6d2a5f1e493ffe27df98028d02a8566
MD5 3f9f07dedfcc0d7e5ca1b1490ae38482
SHA1 45af4966652d18fdd2deecbec0c7968593fe27f5
SHA512 4e0bcea3aa38ccfc789edb28a05b78560248553af1b1a5d1cecc435c4219dc762abe44fb08b07552844b357fbe3600f2142e500d325b46d5cd92804094e4aae6
SSDEEP 3072:jpvJdhoVpPONidvxTZcGovA9mlvnqnviu:jp5oQOvxloo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-30130.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30130.exe
Size 184KB
SHA256 322eada963a6733367f7822db245a2e399157ec2470e7b4a7b91214ec3281ae8
MD5 6e8d668e888be6eeb5a1fe556cb99040
SHA1 eb3a9f293148ba8fe045f4ea6f7717a2ac4853d9
SHA512 f5eeeb12a8147a3a0c210875947ed29bc002fb9ad723b361fb7934cdb258a0a1c6e75d5dcdeaa8a349886e181e1a9292c86f48af4afa64e1b77943131dc2c4e0
SSDEEP 3072:npvJghoVpPwNidvxTZZFovA9mlvnqnviu:np0oKOvxNoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-30684.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-30684.exe
Size 184KB
SHA256 6d113776d5cd02d589772d76ff793dccfbd89377f19533671cb7d60bdf1e13da
MD5 17ce941c4de39da6d59f32a6a9f57e0e
SHA1 e2d3a7bc9f43fff230789114428100f61bce829e
SHA512 5a2943973ef1e0a8a25d7b1b1e2bfe561c7a44feefb7c3e330d61323ee29c0b180222a13962bf81017f4a2ff96904ad3e77ae92f689097bb5f7fb134ad2614f0
SSDEEP 3072:jpvJghoVpPwNidvxTZZGovA9Klvnqnviu:jp0oKOvxeoo9KlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-32463.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-32463.exe
Size 184KB
SHA256 af6521621b9c2710194078bc8745ab2587fe6808b2c53ddaa18e2c8fd466c1f6
MD5 b904708e47b43b54e0d050a59ab5b3fb
SHA1 bd7676a7061d65514e61047b070330cce0f5e183
SHA512 bf41d199e753db7cfb127e6d848ff6778997c65c6daf90919a8bdc35a9e2f1d53d15fb0e8ae8ea33a6f1abea7c0dd2e3852ce5dd8e777348914b8a8680a41bf6
SSDEEP 3072:jpvJghoVpPONidvxTZHGovA9mlvnqnviu:jp0oQOvx8oo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-34842.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-34842.exe
Size 184KB
SHA256 9a931769dea9c480c84e1a2edc29f97dae6d46221e5044b7a11f367a3cce5966
MD5 808d2c221070f913de3463fc91e9e0bd
SHA1 ba933fb6ec11309c77e1d2e722fc3f3fe8b9c161
SHA512 a5996981fb5f064667edbc8a130c9423af7b4c3e4c8ec695b83e5575015e28c2f72f791425d7791fd3a61d4932d980aad2f7e2ab12db0bed28ddbe3d90276538
SSDEEP 3072:/pvJghoVpPwvidvxTZZGovA9xlvnqnviu:/p0oEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-41261.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41261.exe
Size 184KB
SHA256 1b1a2125f0014db92ed7d6bdb3dd775f1244691c03f9c61712d9c1722693d3cb
MD5 fd9db00398f0e129cf42ba8ed1265fc5
SHA1 8366a854bae6c5e43b26eecbf465b2a9e59ed343
SHA512 785882902bb5ab93d85c735544a25ee3bee1b51b3f315d2225a61506c6238ae2cc21a758293b318528d3c7a47a9a3bd1c02b834fc6fc0c2a3ac15cc865ab9276
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9dlvnqnviu:/p0oKOvxeoo9dlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-41584.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-41584.exe
Size 184KB
SHA256 e248fb252f0fd1b66a2ee6467b086973851d418ce0a970602cdce70a04943446
MD5 55cddd9cab7de69fbe21f101e9bd5b64
SHA1 3225f52b6e213ea53d453a8e3713fc369a915df0
SHA512 fb2dc86f72d896ea0bbd391f83463f6c78011345cab93f461ec47e173d4fddd552e4921b06d474947aea3a2c759a1530d99ebb0231ee98561318bf8f324d2792
SSDEEP 3072:jpvJghoVpPwNidvxTZZGovA9mlvnqnviu:jp0oKOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-42382.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-42382.exe
Size 184KB
SHA256 f615af9e58c4ed10df6bf436899c1ea703f8ef4c96ed221e18a51a2dbda226b7
MD5 a3542b7f489c8a48ba260cf22932ef5d
SHA1 212135756b0d59d9364abec4560fce00490186b1
SHA512 5c9aadf60c4139456d85fc6485062e25732ff5ae42b55d632e6e414995ab28956943ce39279fd4bc3824dfa8c4c45f4ef025b9702038c5018d53b5504bc9b742
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9zlvnqnviu:/p0oKOvxeoo9zlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-43128.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-43128.exe
Size 184KB
SHA256 aa7048e34820af4b7c49d99bbd9383c0b6a444cd64e8bae3f1c19b37ced58120
MD5 e4bc277341b2df27513b044cedc7b277
SHA1 23b231efd484d18395876d6fd69ce715ed55013b
SHA512 15d2455c4468edfc0350fab63f5cae26a61fd1e6aa5c760437bef030447cabaae8243a695a5093bcf93a1a13aeb1ca7f22e238fc2082ebaa4cdaa92f7fb7e34a
SSDEEP 3072:/wvJghoVpPwvidvxTZZGovA9xlvnqnviu:/w0oEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-46340.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-46340.exe
Size 184KB
SHA256 063b7750b3dd9d669d8246a37840cea294c297715669d022c8c0c40eba02ac27
MD5 3abde54c395810cb8f994542d08d4e8b
SHA1 696d70fbb6bfa5509c34d441959d93332f13a896
SHA512 fda559cf907355de9fff52c2a5950929f2e2f59770d5f6b138ce5f2231af67e8d3d3544963514331e5e04fdf33ad336d5d96ca610a2311871f5e846bbbeb7137
SSDEEP 3072:/pvJghoVpPwvidvxTZZGovA9zlvnqnviu:/p0oEOvxeoo9zlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-493.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-493.exe
Size 184KB
SHA256 783e651babd3b708503a840ce75b028e4823ccb7422fcbbe2b04a49c43ee19f9
MD5 9eeaa0836ec0217510439f388ac98145
SHA1 73417779dc47f3b151146d805332ac6caa95f134
SHA512 940a82069316bdfcb057f4595045bb559424a3bea2f3aa242a8d2414fa9085c93984a17e797bf08fe979e36cf5bc83670897d53b85fefe3c478f766c316f7e80
SSDEEP 3072:/pvJghoVpVwNidvxTZZGovA9xlvnqn9iu:/p0oEOvxeoo9xlPqn9iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-49325.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-49325.exe
Size 184KB
SHA256 93fe3336d829374e45b498901b56fd7595b0b42861eba502ea3fda71a9b4cfc4
MD5 04258cc7c11f4dc6db864bf05d09d614
SHA1 253f04f357801426f5f74dcc49b2195904e83b01
SHA512 c978bdc75130d7734b31e9e3909731fe8f46b22dcf7620f4147ccaa0b02ef2e5b91cdd8004cf44f0bb5759b711dfc3d9c9bd26f7b83b7232e64aa7ce98c79bc7
SSDEEP 3072:jpvJdhoVpPONidvxTZZGovA9mlvnqnviu:jp5oQOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-50285.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50285.exe
Size 184KB
SHA256 459cdb8c3a0c2ab223655bf758b862ca2f3dc815d2ade09cef3b288869ae1c08
MD5 43a25ad91c7b1f8ea2883b5c2ed43a9f
SHA1 563ea7dfc9c1eddaff3d6455bd5c30e0e4c2a76e
SHA512 6efde802dadbd9af06c2e4fd096d015c7566f07b4fd709ba47d8d113599f8ed774a8e650f5ec1a42b64c267be873e1bd7e20ae1500037c17e61273c98d8cb0ac
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9mlvnqnviu:/p0oKOvxeoo9mlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-50978.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-50978.exe
Size 184KB
SHA256 d67d104f54338e2e3edc7d3478b1cda408835b6083089b14df5740a8427ac265
MD5 fbd72e5a98b4c3c5132c0456494a5e3b
SHA1 a25e4383f62d2931ccb8eb8e365f9cdbe055fd80
SHA512 7440875d9d40188446f774049a3ef1f665bf33426fccfb250be9d700b13ba4f3b157488f0194697156b0f64f21ef2d7b0b554e47cc1d5e9f33d791b9ad22d90b
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9xlvnqnviu:/p0oKOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-54930.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-54930.exe
Size 184KB
SHA256 04b0e6c61dd79a24880703eeeb43bb65ebe3bfcc55326fda53871525e9c75956
MD5 0324ab1e2b9c8cecae6b298a76a793bd
SHA1 9c4611e250397f712518be88be863d57ef32fad9
SHA512 d48ae7adeda0228e86f81bbe84505a8627d2037be2a12c5aef3abf55bbb523692f21af4c9892a8e299bf643f0a35914827745fb682cff6d880e894e9abc4b4ba
SSDEEP 3072:/pvJChoVpPwAidvxTZZGovA9slvnqnviu:/paojOvxeoo9slPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-57862.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-57862.exe
Size 184KB
SHA256 277a6dc19dd93f592a909b6de11ef9c9771216fa4884480174d38b589ec773a4
MD5 3788815d654e5813790b4d26ecbb543e
SHA1 054b2e72fc1f48d666217eab8680ae8f8bfbafcd
SHA512 b476ee22c8eedcb305a1ece82443b02e807b1a92245f10380a5d8dc09937dad7f828665a8267c4a7abfad0c5db74dc56308f1a9c920c2f874492a56393410b99
SSDEEP 3072:npvJghoVpPwNidvxTZZFovA9Hlvnqnviu:np0oKOvxNoo9HlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-59900.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-59900.exe
Size 184KB
SHA256 090ef10a60e82519175a8f40aa5bfd8879bf7a67e223138ae84e9996203c1930
MD5 bfaecef393cbdbe64966fd9e341e6e78
SHA1 9e29d47d45b841a8972f8855a73f8e0ac8a2dcc2
SHA512 72275004af48b3310d15b78f0cbbc38078c5daa8c286f6185cede38c7240ae656308c80adb93f6e139117633047848887f0710c6bc2fd8d23eeec37b40e9da80
SSDEEP 3072:jpvJghoVpPwNidvxTZZGovA9jlvnqnviu:jp0oKOvxeoo9jlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-61184.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61184.exe
Size 184KB
SHA256 3bfb77e496a8518f1e17e1231e4a9e13ad8379f658610bb5f0931873f53aea7a
MD5 e0029204a1ccdd290cefccec653384f5
SHA1 448a4b01c2475212f7c9d5898256c0c3dcb5f6ed
SHA512 ec025549a5520fd4930bdf5beb2ca1fcc1936a0705d0936d83e0a0596d1958fcde4811762b1d59f4cb148f884a6a7060ac1987f2e5b6b1941cb8ec9f309afdcb
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9mlvnqn7iu:/p0oKOvxeoo9mlPqn7iu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-61385.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-61385.exe
Size 184KB
SHA256 9566141ee2ed80dfcefdea8ea3b6a20051ae1b01e9861775ba41ca839d88a33a
MD5 cbad7971e67f1d4e71552fd15fee6053
SHA1 fad0a393da267909d64dd2258b9e0af5aa0eafcb
SHA512 c685e1f017d6ae1f8672a182b9e761eaf86f57fe3f82633fa3fa5302467f8ff5a7726cd98e3964bf22f5e721a382a8f2abd8f1ece07792e133e6d87d06358a39
SSDEEP 3072:/pvJghoVpPwvidvxTZ8GovA9xlvnqnviu:/p0oEOvxtoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-64722.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-64722.exe
Size 184KB
SHA256 0cb059c77aad3e8b5b3b0cd58b47fcb86b94c17cfdd989cd2a684539128ef64d
MD5 fb2b75a334c73aae232cbc1ec9a2dd35
SHA1 972357a58db4c583e7d62ebb391456b89ac9aa34
SHA512 d8cb4f36a22f2a6e970eede67fa60aa375ac9d3b53d2d6cac734efac209607726d00521f4ff8ce6bae31e8d378b17c80ddd93ee00036a1e4b67b99cba92f6cba
SSDEEP 3072:/pvJghoVpPwNidvxTZZGovA9Vlvnqnviu:/p0oKOvxeoo9VlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnicorÏ-7353.exe

Path C:\Users\Admin\AppData\Local\Temp\UnicorÏ-7353.exe
Size 184KB
SHA256 99a4b39076ad37aa2e80e70ee7b730cb1a6152328ca8faa58407905eb34a67ff
MD5 086a9836018cc63df369dd9d71e15e60
SHA1 f699aa83e511bddee0f6a1a81ebc8a1583d1c88d
SHA512 c84fe634cdf0d28d176cc668adb39a71ef62ae8abc682236bd793bec3a98c39ccfc4c55ca26530c4569f616f69d13c61bea90c529ba3f3ac4f982abc6b8b9268
SSDEEP 3072:0wvJghoVpPwvidvxTZZGovA9xlvnqnviu:0w0oEOvxeoo9xlPqnviu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads