f48371f97c30f341eda686deed5ebb374c559ab0c6b949a219c5dd019acb67a9

Analysis

max time kernel
158s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f0d15cef8d93d394f134a92af74d5da0.exe
Size

184KB
MD5

f0d15cef8d93d394f134a92af74d5da0
SHA1

1cc81e62dc3afcb031fe74c69ddf7634713e2d4b
SHA256

f48371f97c30f341eda686deed5ebb374c559ab0c6b949a219c5dd019acb67a9
SHA512

006c79a925c88a05ff45885959e974390ef8b5f997851393fb27bf0f792620bdc6c03bd6b80b29153e9a915a924d617a958f68b153c3eeb17fffb1a51fb281cb
SSDEEP

3072:r20gHefGP1gd6wtWC/8ZhEccvnqnviFZ:r2KUc6w383EccPqnviF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 46 IoCs

pid	Process
1952	Unicorn-23733.exe
2152	Unicorn-17906.exe
3728	Unicorn-54738.exe
4280	Unicorn-19989.exe
1920	Unicorn-31707.exe
4388	Unicorn-3057.exe
1736	Unicorn-31506.exe
4960	Unicorn-11249.exe
1292	Unicorn-45266.exe
628	Unicorn-39899.exe
4632	Unicorn-33455.exe
4988	Unicorn-42203.exe
3564	Unicorn-17653.exe
1584	Unicorn-28370.exe
2376	Unicorn-35765.exe
5072	Unicorn-16859.exe
3980	Unicorn-60217.exe
2968	Unicorn-45298.exe
4192	Unicorn-39823.exe
4712	Unicorn-47602.exe
4636	Unicorn-32940.exe
3096	Unicorn-1079.exe
4276	Unicorn-14574.exe
4992	Unicorn-42482.exe
4796	Unicorn-46287.exe
1704	Unicorn-45555.exe
2496	Unicorn-42255.exe
2008	Unicorn-60812.exe
1532	Unicorn-33039.exe
2248	Unicorn-64019.exe
8	Unicorn-17013.exe
4784	Unicorn-11829.exe
4936	Unicorn-34575.exe
892	Unicorn-37205.exe
1400	Unicorn-3947.exe
3000	Unicorn-14030.exe
4644	Unicorn-45561.exe
3596	Unicorn-7118.exe
3832	Unicorn-7694.exe
3580	Unicorn-54124.exe
1680	Unicorn-57004.exe
3704	Unicorn-54700.exe
1360	Unicorn-22412.exe
3052	Unicorn-49804.exe
2280	Unicorn-49804.exe
5032	Unicorn-65263.exe

Program crash 29 IoCs

pid	pid_target	Process	procid_target
2124	316	WerFault.exe	36
2000	316	WerFault.exe	36
1724	1952	WerFault.exe	92
260	2152	WerFault.exe	95
3532	3728	WerFault.exe	96
3140	2248	WerFault.exe	133
6080	220	WerFault.exe	197
5976	1916	WerFault.exe	268
5732	3688	WerFault.exe	260
2656	3560	WerFault.exe	239
2480	5620	WerFault.exe	281
5796	756	WerFault.exe	311
220	4288	WerFault.exe	312
3844	772	WerFault.exe	310
6132	5176	WerFault.exe	316
5976	6140	WerFault.exe	354
5292	5364	WerFault.exe	390
6072	5112	WerFault.exe	389
748	1044	WerFault.exe	420
3980	6068	WerFault.exe	418
220	3496	WerFault.exe	449
1572	5676	WerFault.exe	469
5040	6008	WerFault.exe	459
2696	4272	WerFault.exe	470
4712	2376	WerFault.exe	536
4896	1840	WerFault.exe	518
5380	5848	WerFault.exe	540
1804	2412	WerFault.exe	549
1420	1684	WerFault.exe	561

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe
1952	Unicorn-23733.exe
2152	Unicorn-17906.exe
3728	Unicorn-54738.exe
4280	Unicorn-19989.exe
1920	Unicorn-31707.exe
4388	Unicorn-3057.exe
1736	Unicorn-31506.exe
4960	Unicorn-11249.exe
1292	Unicorn-45266.exe
628	Unicorn-39899.exe
4632	Unicorn-33455.exe
4988	Unicorn-42203.exe
3564	Unicorn-17653.exe
1584	Unicorn-28370.exe
2376	Unicorn-35765.exe
5072	Unicorn-16859.exe
3980	Unicorn-60217.exe
2968	Unicorn-45298.exe
4192	Unicorn-39823.exe
4712	Unicorn-47602.exe
4636	Unicorn-32940.exe
4276	Unicorn-14574.exe
4992	Unicorn-42482.exe
4796	Unicorn-46287.exe
1704	Unicorn-45555.exe
8	Unicorn-17013.exe
1532	Unicorn-33039.exe
2008	Unicorn-60812.exe
2496	Unicorn-42255.exe
2248	Unicorn-64019.exe
4784	Unicorn-11829.exe
4936	Unicorn-34575.exe
892	Unicorn-37205.exe
1400	Unicorn-3947.exe
3000	Unicorn-14030.exe
4644	Unicorn-45561.exe
3596	Unicorn-7118.exe
3832	Unicorn-7694.exe
3580	Unicorn-54124.exe
1360	Unicorn-22412.exe
1680	Unicorn-57004.exe
3704	Unicorn-54700.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1952	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	92
PID 316 wrote to memory of 1952	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	92
PID 316 wrote to memory of 1952	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	92
PID 1952 wrote to memory of 2152	1952	Unicorn-23733.exe	95
PID 1952 wrote to memory of 2152	1952	Unicorn-23733.exe	95
PID 1952 wrote to memory of 2152	1952	Unicorn-23733.exe	95
PID 2152 wrote to memory of 3728	2152	Unicorn-17906.exe	96
PID 2152 wrote to memory of 3728	2152	Unicorn-17906.exe	96
PID 2152 wrote to memory of 3728	2152	Unicorn-17906.exe	96
PID 1952 wrote to memory of 4280	1952	Unicorn-23733.exe	97
PID 1952 wrote to memory of 4280	1952	Unicorn-23733.exe	97
PID 1952 wrote to memory of 4280	1952	Unicorn-23733.exe	97
PID 2152 wrote to memory of 1920	2152	Unicorn-17906.exe	99
PID 2152 wrote to memory of 1920	2152	Unicorn-17906.exe	99
PID 2152 wrote to memory of 1920	2152	Unicorn-17906.exe	99
PID 3728 wrote to memory of 4388	3728	Unicorn-54738.exe	100
PID 3728 wrote to memory of 4388	3728	Unicorn-54738.exe	100
PID 3728 wrote to memory of 4388	3728	Unicorn-54738.exe	100
PID 4280 wrote to memory of 1736	4280	Unicorn-19989.exe	101
PID 4280 wrote to memory of 1736	4280	Unicorn-19989.exe	101
PID 4280 wrote to memory of 1736	4280	Unicorn-19989.exe	101
PID 316 wrote to memory of 2124	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	103
PID 316 wrote to memory of 2124	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	103
PID 316 wrote to memory of 2124	316	NEAS.f0d15cef8d93d394f134a92af74d5da0.exe	103
PID 4388 wrote to memory of 4960	4388	Unicorn-3057.exe	107
PID 4388 wrote to memory of 4960	4388	Unicorn-3057.exe	107
PID 4388 wrote to memory of 4960	4388	Unicorn-3057.exe	107
PID 1920 wrote to memory of 1292	1920	Unicorn-31707.exe	108
PID 1920 wrote to memory of 1292	1920	Unicorn-31707.exe	108
PID 1920 wrote to memory of 1292	1920	Unicorn-31707.exe	108
PID 3728 wrote to memory of 628	3728	Unicorn-54738.exe	109
PID 3728 wrote to memory of 628	3728	Unicorn-54738.exe	109
PID 3728 wrote to memory of 628	3728	Unicorn-54738.exe	109
PID 1736 wrote to memory of 4632	1736	Unicorn-31506.exe	111
PID 1736 wrote to memory of 4632	1736	Unicorn-31506.exe	111
PID 1736 wrote to memory of 4632	1736	Unicorn-31506.exe	111
PID 4280 wrote to memory of 4988	4280	Unicorn-19989.exe	110
PID 4280 wrote to memory of 4988	4280	Unicorn-19989.exe	110
PID 4280 wrote to memory of 4988	4280	Unicorn-19989.exe	110
PID 4388 wrote to memory of 3564	4388	Unicorn-3057.exe	115
PID 4388 wrote to memory of 3564	4388	Unicorn-3057.exe	115
PID 4388 wrote to memory of 3564	4388	Unicorn-3057.exe	115
PID 4960 wrote to memory of 1584	4960	Unicorn-11249.exe	116
PID 4960 wrote to memory of 1584	4960	Unicorn-11249.exe	116
PID 4960 wrote to memory of 1584	4960	Unicorn-11249.exe	116
PID 1292 wrote to memory of 2376	1292	Unicorn-45266.exe	117
PID 1292 wrote to memory of 2376	1292	Unicorn-45266.exe	117
PID 1292 wrote to memory of 2376	1292	Unicorn-45266.exe	117
PID 1920 wrote to memory of 5072	1920	Unicorn-31707.exe	118
PID 1920 wrote to memory of 5072	1920	Unicorn-31707.exe	118
PID 1920 wrote to memory of 5072	1920	Unicorn-31707.exe	118
PID 1736 wrote to memory of 3980	1736	Unicorn-31506.exe	119
PID 1736 wrote to memory of 3980	1736	Unicorn-31506.exe	119
PID 1736 wrote to memory of 3980	1736	Unicorn-31506.exe	119
PID 4988 wrote to memory of 2968	4988	Unicorn-42203.exe	121
PID 4988 wrote to memory of 2968	4988	Unicorn-42203.exe	121
PID 4988 wrote to memory of 2968	4988	Unicorn-42203.exe	121
PID 628 wrote to memory of 4192	628	Unicorn-39899.exe	120
PID 628 wrote to memory of 4192	628	Unicorn-39899.exe	120
PID 628 wrote to memory of 4192	628	Unicorn-39899.exe	120
PID 4632 wrote to memory of 4712	4632	Unicorn-33455.exe	122
PID 4632 wrote to memory of 4712	4632	Unicorn-33455.exe	122
PID 4632 wrote to memory of 4712	4632	Unicorn-33455.exe	122
PID 3564 wrote to memory of 3096	3564	Unicorn-17653.exe	126

C:\Users\Admin\AppData\Local\Temp\NEAS.f0d15cef8d93d394f134a92af74d5da0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f0d15cef8d93d394f134a92af74d5da0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7118.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        9⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        10⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        11⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        12⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        13⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        14⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        15⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        16⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        17⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9192.exe
        18⤵
        
        PID:500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe
        19⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16585.exe
        20⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7694.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
        9⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        10⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        11⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        12⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57007.exe
        13⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30924.exe
        14⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        15⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        16⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        17⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14807.exe
        18⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        19⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
        20⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 640
        17⤵
        Program crash
        
        PID:220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 628
        14⤵
        Program crash
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        8⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        9⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38671.exe
        10⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        11⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60853.exe
        12⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        13⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        14⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        15⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        16⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10472.exe
        17⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        18⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
        7⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
        8⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        9⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        10⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        11⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14734.exe
        12⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        13⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        14⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1966.exe
        15⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        16⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        17⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55529.exe
        18⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        19⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41193.exe
        20⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 656
        18⤵
        Program crash
        
        PID:4712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 748
        17⤵
        Program crash
        
        PID:2696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 664
        10⤵
        Program crash
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        8⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
        9⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        10⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
        11⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        12⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        13⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        14⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        15⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        16⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4741.exe
        17⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
        18⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60550.exe
        19⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        20⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        8⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        9⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23221.exe
        10⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9451.exe
        11⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30156.exe
        12⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        13⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        14⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        15⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24585.exe
        16⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49560.exe
        17⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4296.exe
        18⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65263.exe
        7⤵
        Executes dropped EXE
        
        PID:5032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 744
        5⤵
        Program crash
        
        PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
        9⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33682.exe
        10⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        11⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        12⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43413.exe
        13⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30319.exe
        14⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
        15⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        16⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        17⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        18⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        19⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24073.exe
        20⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        8⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
        9⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        10⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        11⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        12⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        13⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16140.exe
        14⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57487.exe
        15⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        16⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        17⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48329.exe
        18⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        19⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32140.exe
        8⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        9⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        10⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        11⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        12⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        13⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        14⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15791.exe
        15⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
        16⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        17⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7589.exe
        18⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5896.exe
        19⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        20⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 640
        17⤵
        Program crash
        
        PID:5040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 636
        13⤵
        Program crash
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        8⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        9⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        10⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        11⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        12⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        13⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        14⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48841.exe
        15⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50889.exe
        16⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        17⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10917.exe
        18⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        9⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        10⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43954.exe
        11⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56044.exe
        12⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        13⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        14⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        15⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        16⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        17⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        18⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28361.exe
        19⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        20⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 628
        19⤵
        Program crash
        
        PID:5380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 740
        16⤵
        Program crash
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64690.exe
        9⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62732.exe
        10⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        11⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        12⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        13⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        14⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36568.exe
        15⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1719.exe
        16⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        17⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        18⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 724
        14⤵
        Program crash
        
        PID:6072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 664
        12⤵
        Program crash
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        9⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        10⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
        11⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30127.exe
        12⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        13⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45967.exe
        14⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        15⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        16⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        17⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43928.exe
        18⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 668
        14⤵
        Program crash
        
        PID:5292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 616
        13⤵
        Program crash
        
        PID:5976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 636
        12⤵
        Program crash
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63442.exe
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59564.exe
        8⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        9⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        10⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14859.exe
        11⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58636.exe
        12⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54732.exe
        13⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
        14⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        15⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
        16⤵
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25528.exe
        17⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
        18⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 640
        17⤵
        Program crash
        
        PID:1804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 652
        16⤵
        Program crash
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 744
        15⤵
        Program crash
        
        PID:1572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 640
        10⤵
        Program crash
        
        PID:5732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 752
      4⤵
      Program crash
      PID:260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        9⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19596.exe
        10⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        11⤵
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47279.exe
        12⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        13⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        14⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        15⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2981.exe
        16⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        17⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        18⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        19⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
        20⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22354.exe
        14⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58264.exe
        15⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        16⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20169.exe
        17⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63024.exe
        18⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 664
        15⤵
        Program crash
        
        PID:748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 636
        12⤵
        Program crash
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        8⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
        9⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54418.exe
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        9⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8686.exe
        10⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51887.exe
        11⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        11⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
        12⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16652.exe
        13⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        14⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        7⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19439.exe
        9⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2795.exe
        10⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        11⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        12⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51468.exe
        13⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64440.exe
        14⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11496.exe
        15⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        16⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23497.exe
        17⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 728
        10⤵
        Program crash
        
        PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        8⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42767.exe
        9⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        10⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        11⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30997.exe
        11⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        12⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13138.exe
        13⤵
        
        PID:492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
        14⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        15⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22473.exe
        16⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        17⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
        18⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 652
        17⤵
        Program crash
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        7⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        9⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24597.exe
        10⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        11⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        12⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        13⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
        14⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        15⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        16⤵
        
        PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        6⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2254.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        8⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        9⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        10⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60303.exe
        11⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4619.exe
        12⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        13⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        14⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29350.exe
        15⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        16⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        17⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21769.exe
        18⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 744
        10⤵
        Program crash
        
        PID:2480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 724
        6⤵
        Program crash
        
        PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 744
    3⤵
    - Program crash
    PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 752
  2⤵
  - Program crash
  PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 752
  2⤵
  - Program crash
  PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 316 -ip 316
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1952 -ip 1952
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2152 -ip 2152
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3728 -ip 3728
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4280 -ip 4280
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1920 -ip 1920
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4388 -ip 4388
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1736 -ip 1736
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4960 -ip 4960
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1292 -ip 1292
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4632 -ip 4632
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1584 -ip 1584
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3564 -ip 3564
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 628 -ip 628
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4988 -ip 4988
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2376 -ip 2376
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5072 -ip 5072
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3980 -ip 3980
1⤵
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2968 -ip 2968
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4192 -ip 4192
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4712 -ip 4712
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5032 -ip 5032
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3596 -ip 3596
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8 -ip 8
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4276 -ip 4276
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4636 -ip 4636
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4784 -ip 4784
1⤵
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 892 -ip 892
1⤵
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2008 -ip 2008
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2248 -ip 2248
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1400 -ip 1400
1⤵
PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4796 -ip 4796
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4644 -ip 4644
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3832 -ip 3832
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1704 -ip 1704
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1532 -ip 1532
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4992 -ip 4992
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3580 -ip 3580
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1360 -ip 1360
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1680 -ip 1680
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2280 -ip 2280
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 456 -ip 456
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3704 -ip 3704
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2396 -ip 2396
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1860 -ip 1860
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2492 -ip 2492
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3136 -ip 3136
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2496 -ip 2496
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3460 -ip 3460
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3028 -ip 3028
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4936 -ip 4936
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3000 -ip 3000
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3052 -ip 3052
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4452 -ip 4452
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2232 -ip 2232
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4960 -ip 4960
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1876 -ip 1876
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1684 -ip 1684
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1924 -ip 1924
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1840 -ip 1840
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 116 -ip 116
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4208 -ip 4208
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 944 -ip 944
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3980 -ip 3980
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1904 -ip 1904
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1392 -ip 1392
1⤵
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2968 -ip 2968
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4172 -ip 4172
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2736 -ip 2736
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1120 -ip 1120
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3264 -ip 3264
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2656 -ip 2656
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1384 -ip 1384
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3692 -ip 3692
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 220 -ip 220
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3612 -ip 3612
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1920 -ip 1920
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2324 -ip 2324
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 752 -ip 752
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4228 -ip 4228
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2776 -ip 2776
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1560 -ip 1560
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4192 -ip 4192
1⤵
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 892 -ip 892
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1752 -ip 1752
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4352 -ip 4352
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4400 -ip 4400
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4032 -ip 4032
1⤵
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4480 -ip 4480
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2008 -ip 2008
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4300 -ip 4300
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3596 -ip 3596
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3768 -ip 3768
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1008 -ip 1008
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2836 -ip 2836
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1916 -ip 1916
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3560 -ip 3560
1⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3688 -ip 3688
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4436 -ip 4436
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4760 -ip 4760
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4088 -ip 4088
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1836 -ip 1836
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5324 -ip 5324
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5376 -ip 5376
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5428 -ip 5428
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5396 -ip 5396
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5224 -ip 5224
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4676 -ip 4676
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5408 -ip 5408
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3104 -ip 3104
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2532 -ip 2532
1⤵
PID:492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5612 -ip 5612
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5620 -ip 5620
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5712 -ip 5712
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2256 -ip 2256
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3804 -ip 3804
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4892 -ip 4892
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4364 -ip 4364
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2580 -ip 2580
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1576 -ip 1576
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4472 -ip 4472
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4288 -ip 4288
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 756 -ip 756
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5176 -ip 5176
1⤵
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4224 -ip 4224
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3680 -ip 3680
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3144 -ip 3144
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 772 -ip 772
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5136 -ip 5136
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5576 -ip 5576
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1996 -ip 1996
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2808 -ip 2808
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4044 -ip 4044
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5184 -ip 5184
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5452 -ip 5452
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5372 -ip 5372
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5860 -ip 5860
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2028 -ip 2028
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5288 -ip 5288
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2364 -ip 2364
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 1072 -ip 1072
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1184 -ip 1184
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2576 -ip 2576
1⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6140 -ip 6140
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4796 -ip 4796
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5980 -ip 5980
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1296 -ip 1296
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2108 -ip 2108
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 556 -ip 556
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2324 -ip 2324
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1676 -ip 1676
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 944 -ip 944
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2620 -ip 2620
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4960 -ip 4960
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3872 -ip 3872
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2396 -ip 2396
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3596 -ip 3596
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5348 -ip 5348
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2412 -ip 2412
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 896 -ip 896
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4988 -ip 4988
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3292 -ip 3292
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1540 -ip 1540
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3900 -ip 3900
1⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5364 -ip 5364
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5112 -ip 5112
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2132 -ip 2132
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5580 -ip 5580
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1044 -ip 1044
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5768 -ip 5768
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6032 -ip 6032
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2856 -ip 2856
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4792 -ip 4792
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1784 -ip 1784
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5588 -ip 5588
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4844 -ip 4844
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3248 -ip 3248
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3444 -ip 3444
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5992 -ip 5992
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6068 -ip 6068
1⤵
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4676 -ip 4676
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5532 -ip 5532
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 492 -ip 492
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4316 -ip 4316
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 568 -ip 568
1⤵
PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1356 -ip 1356
1⤵
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5920 -ip 5920
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4416 -ip 4416
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5440 -ip 5440
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2124 -ip 2124
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2064 -ip 2064
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3268 -ip 3268
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5736 -ip 5736
1⤵
PID:5664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1392 -ip 1392
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3496 -ip 3496
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5676 -ip 5676
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 1736 -ip 1736
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 532 -ip 532
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5884 -ip 5884
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6008 -ip 6008
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2248 -ip 2248
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4272 -ip 4272
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1636 -ip 1636
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5744 -ip 5744
1⤵
PID:988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5972 -ip 5972
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5304 -ip 5304
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3556 -ip 3556
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 816 -ip 816
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5728 -ip 5728
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3820 -ip 3820
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4636 -ip 4636
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1420 -ip 1420
1⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4724 -ip 4724
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4188 -ip 4188
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5708 -ip 5708
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5752 -ip 5752
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1840 -ip 1840
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2376 -ip 2376
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5404 -ip 5404
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1932 -ip 1932
1⤵
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3756 -ip 3756
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2364 -ip 2364
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5820 -ip 5820
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3824 -ip 3824
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4980 -ip 4980
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1528 -ip 1528
1⤵
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1724 -ip 1724
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3632 -ip 3632
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5680 -ip 5680
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4748 -ip 4748
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5848 -ip 5848
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3804 -ip 3804
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 500 -ip 500
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5656 -ip 5656
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1704 -ip 1704
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4572 -ip 4572
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4472 -ip 4472
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5348 -ip 5348
1⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1684 -ip 1684
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5344 -ip 5344
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4832 -ip 4832
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2412 -ip 2412
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2496 -ip 2496
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 4452 -ip 4452
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5672 -ip 5672
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2640 -ip 2640
1⤵
PID:3996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe

Filesize
184KB

MD5
bdeeff71bafdbd05965399cd77b4fbe1

SHA1
830464cf069634dfff9910d203cd7c4a86ec8f58

SHA256
aa96e5aac5e4e3bd6afaffb95738ca30b3d78734084940b5254385665f37f33a

SHA512
2fc2930f0354fb3f194f320b1e9d54631b7fd091ad10ee20941c2f89779a979b829707f50d7ef1dd3afa904ba84530d936ecc029af6c6bc3a04497c26051aaf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe

Filesize
184KB

MD5
bdeeff71bafdbd05965399cd77b4fbe1

SHA1
830464cf069634dfff9910d203cd7c4a86ec8f58

SHA256
aa96e5aac5e4e3bd6afaffb95738ca30b3d78734084940b5254385665f37f33a

SHA512
2fc2930f0354fb3f194f320b1e9d54631b7fd091ad10ee20941c2f89779a979b829707f50d7ef1dd3afa904ba84530d936ecc029af6c6bc3a04497c26051aaf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe

Filesize
184KB

MD5
418b097697d1d8480181d01015a0e5f2

SHA1
a52fa0c2c95bccdba7c328ec55f0e13ff3c9e8a4

SHA256
2a597fa40ca0454b4480f37dd3a6440fe6809837d071323b78d770cea7498b52

SHA512
3aee9bb45a36dd5d9106f7fd90b6f61adb1665a5ba06780c2d6afe07232ca22e64ab62196b9e276465ff26256462bed5ede8c6c494a8c2d1a760f05ee8ee25da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11249.exe

Filesize
184KB

MD5
418b097697d1d8480181d01015a0e5f2

SHA1
a52fa0c2c95bccdba7c328ec55f0e13ff3c9e8a4

SHA256
2a597fa40ca0454b4480f37dd3a6440fe6809837d071323b78d770cea7498b52

SHA512
3aee9bb45a36dd5d9106f7fd90b6f61adb1665a5ba06780c2d6afe07232ca22e64ab62196b9e276465ff26256462bed5ede8c6c494a8c2d1a760f05ee8ee25da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe

Filesize
184KB

MD5
fad7cf98063f2d559ac75875b7b202c0

SHA1
c58875c25ea2151842f70af988335aa449554896

SHA256
9a23257d548f2b5af902f832a3ec90c42300bd70911ac7d7ddbe8b7eb32c3286

SHA512
7163817426b54898f844d02844ea24cc0c62346e99d2e1b6d4cc0886cc1ceaafc5c676c76c3e4014315a033b23af7465e0dec5c9c59bd30047370889647674d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe

Filesize
184KB

MD5
fad7cf98063f2d559ac75875b7b202c0

SHA1
c58875c25ea2151842f70af988335aa449554896

SHA256
9a23257d548f2b5af902f832a3ec90c42300bd70911ac7d7ddbe8b7eb32c3286

SHA512
7163817426b54898f844d02844ea24cc0c62346e99d2e1b6d4cc0886cc1ceaafc5c676c76c3e4014315a033b23af7465e0dec5c9c59bd30047370889647674d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe

Filesize
184KB

MD5
fad7cf98063f2d559ac75875b7b202c0

SHA1
c58875c25ea2151842f70af988335aa449554896

SHA256
9a23257d548f2b5af902f832a3ec90c42300bd70911ac7d7ddbe8b7eb32c3286

SHA512
7163817426b54898f844d02844ea24cc0c62346e99d2e1b6d4cc0886cc1ceaafc5c676c76c3e4014315a033b23af7465e0dec5c9c59bd30047370889647674d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe

Filesize
184KB

MD5
0a9ae79983e81a2c20cec50dab5b56b9

SHA1
5bd6625f1ae31db82ade7a50e93bb86babf30dce

SHA256
354aa79b0ee5f8a1578da1f11753d8f012dde79b89c04c982636b0e8221522b5

SHA512
e07f24ba4e66c33cedf432cff181aba0e13ed8869d8812487f455c1c5552b1b10c096160b8afc06197b1c6a20d6f9e2235ca5bcefe67b19282a139049a689a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe

Filesize
184KB

MD5
0a9ae79983e81a2c20cec50dab5b56b9

SHA1
5bd6625f1ae31db82ade7a50e93bb86babf30dce

SHA256
354aa79b0ee5f8a1578da1f11753d8f012dde79b89c04c982636b0e8221522b5

SHA512
e07f24ba4e66c33cedf432cff181aba0e13ed8869d8812487f455c1c5552b1b10c096160b8afc06197b1c6a20d6f9e2235ca5bcefe67b19282a139049a689a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe

Filesize
184KB

MD5
cead9571e3ba27e6c0748f9ba9635747

SHA1
6cf74007d453de6fc87e037ffc1500c073231f1e

SHA256
2beaa03cc348bcc8aa632709eabaacfdad796c73bd44dcbf5fe12d51591078df

SHA512
6a0cd62555aafb95f1ee3c63f408941b6a7aa3de2729f238fcb6a713b32d7ac8f6c62179c3e0ed811d46c3cf3a0d75b0bb0653f8f9b22ca9604f0815e080e48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe

Filesize
184KB

MD5
cead9571e3ba27e6c0748f9ba9635747

SHA1
6cf74007d453de6fc87e037ffc1500c073231f1e

SHA256
2beaa03cc348bcc8aa632709eabaacfdad796c73bd44dcbf5fe12d51591078df

SHA512
6a0cd62555aafb95f1ee3c63f408941b6a7aa3de2729f238fcb6a713b32d7ac8f6c62179c3e0ed811d46c3cf3a0d75b0bb0653f8f9b22ca9604f0815e080e48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe

Filesize
184KB

MD5
e11280d783d771b7b0c9a2d4a87ef734

SHA1
139914fb41843886fdcf24422004e448905a33e6

SHA256
fcf1d4a017cdd3195fdff9fed324e1f76a17b8c60816c09473de1c6816d35fed

SHA512
0bba1cb6cb9a5218b30dbc4791b97ba410653fe8ef1e09fde2ee8e0f6e19f45d3117fd74253fdaa11177acc4710b3fb2c13fdea41d4e9e762f056785c8cda83d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe

Filesize
184KB

MD5
e11280d783d771b7b0c9a2d4a87ef734

SHA1
139914fb41843886fdcf24422004e448905a33e6

SHA256
fcf1d4a017cdd3195fdff9fed324e1f76a17b8c60816c09473de1c6816d35fed

SHA512
0bba1cb6cb9a5218b30dbc4791b97ba410653fe8ef1e09fde2ee8e0f6e19f45d3117fd74253fdaa11177acc4710b3fb2c13fdea41d4e9e762f056785c8cda83d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe

Filesize
184KB

MD5
d3a8c907b25b8fe8795086071e952adc

SHA1
778a6d4975dd0ece92e01dd7650850a996ce47a0

SHA256
4bb5e38a9a53772e987c39feb937d09cc8873b28817a66c8ab4d7f60eea74db7

SHA512
ac224d4600a832933d18c41baa3e10f3073bcc224b7952b42d99b0ff02196a0dcdc981142f3da7f029fb951e1cfdf2515b2e8c26963262e4ec7a97b0927e0bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe

Filesize
184KB

MD5
d3a8c907b25b8fe8795086071e952adc

SHA1
778a6d4975dd0ece92e01dd7650850a996ce47a0

SHA256
4bb5e38a9a53772e987c39feb937d09cc8873b28817a66c8ab4d7f60eea74db7

SHA512
ac224d4600a832933d18c41baa3e10f3073bcc224b7952b42d99b0ff02196a0dcdc981142f3da7f029fb951e1cfdf2515b2e8c26963262e4ec7a97b0927e0bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe

Filesize
184KB

MD5
6bb2f9fd85ccaf3d3581762fa734db5e

SHA1
740874ae3f5f57adea02605fb480c6dccb5ccaa9

SHA256
fcb4e545b0e40b7ac6d6984b2aa3d415cfc6ba6b6fbaeea79d7b826a6386ab57

SHA512
af9020cc6efb195d7c2d4ded9f4d197cd4eb09cf98bcdbf50cfb77e93432ec846f2cf4b92b670d8a10796dbe5bbb19b81f82a54e5140a35947020f38f83e268a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe

Filesize
184KB

MD5
6bb2f9fd85ccaf3d3581762fa734db5e

SHA1
740874ae3f5f57adea02605fb480c6dccb5ccaa9

SHA256
fcb4e545b0e40b7ac6d6984b2aa3d415cfc6ba6b6fbaeea79d7b826a6386ab57

SHA512
af9020cc6efb195d7c2d4ded9f4d197cd4eb09cf98bcdbf50cfb77e93432ec846f2cf4b92b670d8a10796dbe5bbb19b81f82a54e5140a35947020f38f83e268a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe

Filesize
184KB

MD5
150dd36cb139c75f50f464dd97fb725a

SHA1
3e2c7cdb1c84e10de65fb886d6e4bc8655381cfd

SHA256
8a10cedb824186897ccda3ad479fe406cabcbad64e2ac807dbfd06dae0180179

SHA512
6b50807279667eedbed5b96a8f58b2a5c915a157408ee3616c716a2bd9897ec1a8cf96930b8084c773d906d447f56e64025853c133e12e873303d076062e5e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe

Filesize
184KB

MD5
150dd36cb139c75f50f464dd97fb725a

SHA1
3e2c7cdb1c84e10de65fb886d6e4bc8655381cfd

SHA256
8a10cedb824186897ccda3ad479fe406cabcbad64e2ac807dbfd06dae0180179

SHA512
6b50807279667eedbed5b96a8f58b2a5c915a157408ee3616c716a2bd9897ec1a8cf96930b8084c773d906d447f56e64025853c133e12e873303d076062e5e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23224.exe

Filesize
184KB

MD5
0ad2d6aaf37ee80da90c72becb11a12f

SHA1
ca5d84048034ed0ed789223b6387135505bbe676

SHA256
809984b95b6dba227e5e52d5c1bed78cef7061e73f60429975596c2cab4d05bf

SHA512
701d44d4258463f87b44b56cd4597a656554fe9afa51cf0e8cfc7dbe73c8a8d18b0e5bdcf6fffbf1e77c0031d7b20ca9528af6b078ac75e4ee903f1adebb889a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe

Filesize
184KB

MD5
5e9d3453c4d4ffc9a306e379b6674f63

SHA1
bf0c81fe3db776eb6c1b2460b5c2e60ea5bb3b27

SHA256
0ec9f7896f80cb2a5c77e4271ba02e4034c4b88c43c38b26974f59465e03fbd5

SHA512
e24be10bbefca4b7b98729c2c45de3176c90bf5fee95f27f53374cc3815e722382ea09b5b38b3cad92b382726180ec8da6a054dcfad244c543fdcb00f34cda58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe

Filesize
184KB

MD5
5e9d3453c4d4ffc9a306e379b6674f63

SHA1
bf0c81fe3db776eb6c1b2460b5c2e60ea5bb3b27

SHA256
0ec9f7896f80cb2a5c77e4271ba02e4034c4b88c43c38b26974f59465e03fbd5

SHA512
e24be10bbefca4b7b98729c2c45de3176c90bf5fee95f27f53374cc3815e722382ea09b5b38b3cad92b382726180ec8da6a054dcfad244c543fdcb00f34cda58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe

Filesize
184KB

MD5
cfbe83790e0583a22b4fe6a2a4694cf7

SHA1
115272d69a5636c3bbe8d800a3fa059456c9cafc

SHA256
c3042a210ba9dc03b16bacd9516de840cd230ca67ac88c60614268a124596783

SHA512
78ccb8bee1b3492a392944abc9ccf90abe63a038c18f87962cfc8c57e4a36b890240d516a05fe7316092968c6fd0810b0d1cd26a6b390bc17dfca48005a41b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe

Filesize
184KB

MD5
cfbe83790e0583a22b4fe6a2a4694cf7

SHA1
115272d69a5636c3bbe8d800a3fa059456c9cafc

SHA256
c3042a210ba9dc03b16bacd9516de840cd230ca67ac88c60614268a124596783

SHA512
78ccb8bee1b3492a392944abc9ccf90abe63a038c18f87962cfc8c57e4a36b890240d516a05fe7316092968c6fd0810b0d1cd26a6b390bc17dfca48005a41b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe

Filesize
184KB

MD5
194b97b6c36446dfbaa9e5946e4bdbcb

SHA1
6207b8bcce7243d391f4d2e66f8bfa4bd674e887

SHA256
ed1869c6d6d55ab3bee465ac5f9770cffa3ddbcc1eb548ceb002c70652098f84

SHA512
dd4644ee5fb4e619cb62ccf957d1891a775666c96a708fb7b660c9f42f789760c554ceea0f255da7c18f3364f1c94996a622f2497838ece823b0007048109455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3057.exe

Filesize
184KB

MD5
194b97b6c36446dfbaa9e5946e4bdbcb

SHA1
6207b8bcce7243d391f4d2e66f8bfa4bd674e887

SHA256
ed1869c6d6d55ab3bee465ac5f9770cffa3ddbcc1eb548ceb002c70652098f84

SHA512
dd4644ee5fb4e619cb62ccf957d1891a775666c96a708fb7b660c9f42f789760c554ceea0f255da7c18f3364f1c94996a622f2497838ece823b0007048109455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe

Filesize
184KB

MD5
7fc707f7b1311fd76ffcd25d9e1a02cf

SHA1
09c8d179e62f17df9b292466d0834d2ec78cf445

SHA256
a00d86bab1226d4f69b9415f7bcc13d6afe796796cfc3864bd654b0e1ed9adbf

SHA512
8e7dcd7fb6f205db02fd6f6f5bb3dfa906303fe1c24c9228902fdf771611b659da48facac286acb25d9157287e1b4b8cb0c10a28b3ecc159cb955df5a6cd28bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31506.exe

Filesize
184KB

MD5
7fc707f7b1311fd76ffcd25d9e1a02cf

SHA1
09c8d179e62f17df9b292466d0834d2ec78cf445

SHA256
a00d86bab1226d4f69b9415f7bcc13d6afe796796cfc3864bd654b0e1ed9adbf

SHA512
8e7dcd7fb6f205db02fd6f6f5bb3dfa906303fe1c24c9228902fdf771611b659da48facac286acb25d9157287e1b4b8cb0c10a28b3ecc159cb955df5a6cd28bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe

Filesize
184KB

MD5
19d59213e9ca48624da669c29697bee0

SHA1
3295775b833423c6930e320968735447c38e796e

SHA256
5ab3ebf78eb5e9c9cb1fd8d92bbd6cfb134f2c5d576cebfb92c645cd65961cd3

SHA512
8487cfedd8f451c709a0cf60580c5e4bacab1405f68c81a92de0e4555b64def981ad433a74ec846f599e6b610c5a9d20ed1f5c211de78886e3bd7b73dbe74d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe

Filesize
184KB

MD5
19d59213e9ca48624da669c29697bee0

SHA1
3295775b833423c6930e320968735447c38e796e

SHA256
5ab3ebf78eb5e9c9cb1fd8d92bbd6cfb134f2c5d576cebfb92c645cd65961cd3

SHA512
8487cfedd8f451c709a0cf60580c5e4bacab1405f68c81a92de0e4555b64def981ad433a74ec846f599e6b610c5a9d20ed1f5c211de78886e3bd7b73dbe74d5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe

Filesize
184KB

MD5
823df24d84c329cd6861c2c55b279622

SHA1
1803b8a20750a63084bd27e264fe769e27c39c88

SHA256
02d037cee4d1e6e1e1e081b88c2e66f84138e2469d119f3a434135a9f5156bfc

SHA512
873b7a8093b23ec66eaf8459531912e2daa48cb04a9bdae69ff26d06d96ab1834bf75a4101e5cefeb86506a4043c192603c43237efbf68a8a1b2e748fabcdf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe

Filesize
184KB

MD5
823df24d84c329cd6861c2c55b279622

SHA1
1803b8a20750a63084bd27e264fe769e27c39c88

SHA256
02d037cee4d1e6e1e1e081b88c2e66f84138e2469d119f3a434135a9f5156bfc

SHA512
873b7a8093b23ec66eaf8459531912e2daa48cb04a9bdae69ff26d06d96ab1834bf75a4101e5cefeb86506a4043c192603c43237efbf68a8a1b2e748fabcdf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe

Filesize
184KB

MD5
ccf2a47d73abdf2181a560dd7db8e2bf

SHA1
ec63dc778302246154e05cb89b6a6ff490b9cb41

SHA256
696041d7e2fad598831430188acfcebde9e94e51e555f64272fd9bc7b69f9c26

SHA512
1a0af03b903f0e6ae414dd3aa24baa79b2e29e560ada1df653928397174276bf3a5baf654fd166015e587afb3463c34dfda37e1cbeead0639eff46fe82d6dd5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe

Filesize
184KB

MD5
ccf2a47d73abdf2181a560dd7db8e2bf

SHA1
ec63dc778302246154e05cb89b6a6ff490b9cb41

SHA256
696041d7e2fad598831430188acfcebde9e94e51e555f64272fd9bc7b69f9c26

SHA512
1a0af03b903f0e6ae414dd3aa24baa79b2e29e560ada1df653928397174276bf3a5baf654fd166015e587afb3463c34dfda37e1cbeead0639eff46fe82d6dd5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe

Filesize
184KB

MD5
ca3f22369307cf0c77b6249089ef14f3

SHA1
4550d473c4bf156bcea9d9ceed6b6ea460272680

SHA256
2033d2d070d188610173429521890c1dc05ebb21b3bc803a08331ce6bad8814d

SHA512
18c7523d54fa1bb3a03282ea10b2e87b06482b41ff1deb1de8f58a1f1c83639a6456e46a379d5166cbbf8a1fdd8658d555ef8471036eb87835faf57d8bbc898b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33455.exe

Filesize
184KB

MD5
ca3f22369307cf0c77b6249089ef14f3

SHA1
4550d473c4bf156bcea9d9ceed6b6ea460272680

SHA256
2033d2d070d188610173429521890c1dc05ebb21b3bc803a08331ce6bad8814d

SHA512
18c7523d54fa1bb3a03282ea10b2e87b06482b41ff1deb1de8f58a1f1c83639a6456e46a379d5166cbbf8a1fdd8658d555ef8471036eb87835faf57d8bbc898b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe

Filesize
184KB

MD5
fcdf2979afc4a3ba061720960ddccd84

SHA1
86c6dce41cdce13000548518cf882a67a5610aa5

SHA256
bdb07036c064f946041fd056975f2714610340549fe0d8b90efe463acf70c877

SHA512
4a921d5e088405cce87b3138d4ff1428e246b1319d0faf820b123050a613dc964de783c9b427ef7561e1a563ce5794234663c58c8966c6ab2d1b8fba6b6ed67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35765.exe

Filesize
184KB

MD5
fcdf2979afc4a3ba061720960ddccd84

SHA1
86c6dce41cdce13000548518cf882a67a5610aa5

SHA256
bdb07036c064f946041fd056975f2714610340549fe0d8b90efe463acf70c877

SHA512
4a921d5e088405cce87b3138d4ff1428e246b1319d0faf820b123050a613dc964de783c9b427ef7561e1a563ce5794234663c58c8966c6ab2d1b8fba6b6ed67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe

Filesize
184KB

MD5
6a19143bbecf6a36ddf9fb4ff3de5dbe

SHA1
7501a378b76bb52628fbb4dd684b8f211fb04e39

SHA256
53c115912e74f0de9078729a83c4aa48dc40afdebee22b410a407d14a909f710

SHA512
06579abd3ade7f950af354b9c3af9ae2ed7ba9112b8e1c6e55f5e696621dafbd75e3228df5d3a9e2709eda7a8ff8b58902c881a626b5e94ec169aaea94f1c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe

Filesize
184KB

MD5
6a19143bbecf6a36ddf9fb4ff3de5dbe

SHA1
7501a378b76bb52628fbb4dd684b8f211fb04e39

SHA256
53c115912e74f0de9078729a83c4aa48dc40afdebee22b410a407d14a909f710

SHA512
06579abd3ade7f950af354b9c3af9ae2ed7ba9112b8e1c6e55f5e696621dafbd75e3228df5d3a9e2709eda7a8ff8b58902c881a626b5e94ec169aaea94f1c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe

Filesize
184KB

MD5
8199215e3201850687f0c93076cda24c

SHA1
837a274c01a9861f1c9d3cdff82ff9c1b650ce2c

SHA256
4f51ca6b2b9f46d05cf38df27055654113c0ce9a7707219f3eb7bfcbee43a3ce

SHA512
aecd1309ea08a210bd2110d5c08411b864ec7d5de946a2fca9bc53ef532dcb5ca82c0082e58322bb3440736333c443335da3cefad5802bc75fc7cd242ea77dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe

Filesize
184KB

MD5
8199215e3201850687f0c93076cda24c

SHA1
837a274c01a9861f1c9d3cdff82ff9c1b650ce2c

SHA256
4f51ca6b2b9f46d05cf38df27055654113c0ce9a7707219f3eb7bfcbee43a3ce

SHA512
aecd1309ea08a210bd2110d5c08411b864ec7d5de946a2fca9bc53ef532dcb5ca82c0082e58322bb3440736333c443335da3cefad5802bc75fc7cd242ea77dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe

Filesize
184KB

MD5
ebd507a70a744354bb9e9349ea8034b3

SHA1
44eb9611cbc398fa49407fc03e5708c923841702

SHA256
5ddcd4cebf970155ef7d85fea0f38a1401983cf4785aea13c689dd3602ce0acc

SHA512
9d6f7814608a5085357e58b2107edf8a5e11625c107f9d108a81220549c5463477d0d0dec0623d4e147cbab1a2916a6bb89904953958da82566fb6c0cb1f1ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe

Filesize
184KB

MD5
ebd507a70a744354bb9e9349ea8034b3

SHA1
44eb9611cbc398fa49407fc03e5708c923841702

SHA256
5ddcd4cebf970155ef7d85fea0f38a1401983cf4785aea13c689dd3602ce0acc

SHA512
9d6f7814608a5085357e58b2107edf8a5e11625c107f9d108a81220549c5463477d0d0dec0623d4e147cbab1a2916a6bb89904953958da82566fb6c0cb1f1ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe

Filesize
184KB

MD5
149563a5a5f00a0625fcf7f40915d59d

SHA1
cb8de2c22f3526b627f97e1e5349eedc255d7e2a

SHA256
49974728451dad934c6943dd99f79469752b4d694af4945a0438eb896e928ed7

SHA512
98c868989adea815c6da6ed43dbdf80a67cee077e08a53fa26e20b5cbe50b41d55be3b4168f5fe48146dd8896b02ff93eb521731a3cc9e5883cd825f9779bf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42255.exe

Filesize
184KB

MD5
149563a5a5f00a0625fcf7f40915d59d

SHA1
cb8de2c22f3526b627f97e1e5349eedc255d7e2a

SHA256
49974728451dad934c6943dd99f79469752b4d694af4945a0438eb896e928ed7

SHA512
98c868989adea815c6da6ed43dbdf80a67cee077e08a53fa26e20b5cbe50b41d55be3b4168f5fe48146dd8896b02ff93eb521731a3cc9e5883cd825f9779bf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe

Filesize
184KB

MD5
036bdbae7a67299d68916c6abe549d6e

SHA1
d7f188074abf450b1e1f580345ae65d6288b03e2

SHA256
bd16c875e208eff57d2a7a76767d9b45297aadb47ad218c7502607a4910900ff

SHA512
d554919a7ac53f7e10a45a36149069ccd140f000bfd459052bc5548de53e3a13cf7dbcd1bfd7445b6fb62241078afb12c810c7b2620f80d63bf01c8ea495b641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42482.exe

Filesize
184KB

MD5
036bdbae7a67299d68916c6abe549d6e

SHA1
d7f188074abf450b1e1f580345ae65d6288b03e2

SHA256
bd16c875e208eff57d2a7a76767d9b45297aadb47ad218c7502607a4910900ff

SHA512
d554919a7ac53f7e10a45a36149069ccd140f000bfd459052bc5548de53e3a13cf7dbcd1bfd7445b6fb62241078afb12c810c7b2620f80d63bf01c8ea495b641

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe

Filesize
184KB

MD5
e7220abc53fdd05cf26ec4164129e0f5

SHA1
b26b0c042c315511f98b7fb5aa929e3c921415af

SHA256
fa9c1c8ec33468fc47a3aae0fe54db16937ed4b93b701456c3af6c31d7c8635d

SHA512
212e2c6f55679906f0f81ba23d14f79a9bacc1e9e5f6725aa4ae532fea886abf584e00bfb1b482d353f9c3621d2fa50b55aa0d76559efbb6027a113b1dba51d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe

Filesize
184KB

MD5
e7220abc53fdd05cf26ec4164129e0f5

SHA1
b26b0c042c315511f98b7fb5aa929e3c921415af

SHA256
fa9c1c8ec33468fc47a3aae0fe54db16937ed4b93b701456c3af6c31d7c8635d

SHA512
212e2c6f55679906f0f81ba23d14f79a9bacc1e9e5f6725aa4ae532fea886abf584e00bfb1b482d353f9c3621d2fa50b55aa0d76559efbb6027a113b1dba51d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe

Filesize
184KB

MD5
72acf71725df6fff4bb4267bfc807833

SHA1
a8c81e81a2743689f70de3811720725f85850689

SHA256
eb1eb3a31293ae63c4857e75186c8f98292cf5963f0a43dd954c8d1d32713e3b

SHA512
b7e5da65693af46d09712a68877ab6907046c70c80d5d0615414a720c260b27793f4fc3653e8091dcdb390518a3ff240451843a973f606db017fbf35c41ee6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe

Filesize
184KB

MD5
72acf71725df6fff4bb4267bfc807833

SHA1
a8c81e81a2743689f70de3811720725f85850689

SHA256
eb1eb3a31293ae63c4857e75186c8f98292cf5963f0a43dd954c8d1d32713e3b

SHA512
b7e5da65693af46d09712a68877ab6907046c70c80d5d0615414a720c260b27793f4fc3653e8091dcdb390518a3ff240451843a973f606db017fbf35c41ee6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe

Filesize
184KB

MD5
4e9dec0eca1f02722820ad5f3497f7ce

SHA1
f4e55bfc7be3500c481babd26159494854c033f5

SHA256
bc5a6ffe5f12c1ce8ec521cba03ff568b48eeb1680f073a9499136133c64fbcd

SHA512
60eebcb03a400f13407963f4eb01045dedb968038ec4ae67da99eca61d878fa619da9344fa22ad2e2a282b95a885c2d23b3928a79ef36d149e7b262ec92e853a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe

Filesize
184KB

MD5
4e9dec0eca1f02722820ad5f3497f7ce

SHA1
f4e55bfc7be3500c481babd26159494854c033f5

SHA256
bc5a6ffe5f12c1ce8ec521cba03ff568b48eeb1680f073a9499136133c64fbcd

SHA512
60eebcb03a400f13407963f4eb01045dedb968038ec4ae67da99eca61d878fa619da9344fa22ad2e2a282b95a885c2d23b3928a79ef36d149e7b262ec92e853a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe

Filesize
184KB

MD5
e2790196ee0c7c09b720ae5618a82630

SHA1
fc5dedd2d95a6b29b13f657b935c9f23437ba5bb

SHA256
4bf167229b657c6920e3da459a5090356c42a3e7e7eaa06a8e1c32c7cb3a84e6

SHA512
7f9d4261d0ecc9188a2d676e3bd3f99b5f4a827b46545ed51063e01bd9555c70b6ad9e0cfc5a7332f0a501d564a2114c810c4a7501c19b36f6d2e04d635b03fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe

Filesize
184KB

MD5
e2790196ee0c7c09b720ae5618a82630

SHA1
fc5dedd2d95a6b29b13f657b935c9f23437ba5bb

SHA256
4bf167229b657c6920e3da459a5090356c42a3e7e7eaa06a8e1c32c7cb3a84e6

SHA512
7f9d4261d0ecc9188a2d676e3bd3f99b5f4a827b46545ed51063e01bd9555c70b6ad9e0cfc5a7332f0a501d564a2114c810c4a7501c19b36f6d2e04d635b03fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe

Filesize
184KB

MD5
ab96e4c8b1dc3bb5dc5cf1b24b86e855

SHA1
7bb5d66343fab42f55d03c766748e00d6662aa6a

SHA256
15e39977474cab57e15ce5f301babbb0712c84cc27b0bed98c6870424ea75346

SHA512
c0dc7198cae106477f8dd8ea6f5514a2ae66936dcdc867539de23fd3da5fb82f482a9ebc77e0d37aeb7bf453a26ba457d924f771c0f528011b46fa7c6d69b951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47602.exe

Filesize
184KB

MD5
ab96e4c8b1dc3bb5dc5cf1b24b86e855

SHA1
7bb5d66343fab42f55d03c766748e00d6662aa6a

SHA256
15e39977474cab57e15ce5f301babbb0712c84cc27b0bed98c6870424ea75346

SHA512
c0dc7198cae106477f8dd8ea6f5514a2ae66936dcdc867539de23fd3da5fb82f482a9ebc77e0d37aeb7bf453a26ba457d924f771c0f528011b46fa7c6d69b951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe

Filesize
184KB

MD5
08ceb578d9a14ed7b554ab544bcbb44b

SHA1
7793f7f345e50c8ca3c703102f300a34dc7523ee

SHA256
d63d98a17c405bdfb9c8da460bc8706e0b841ff56dc740e5b18d5cbe6dbabd31

SHA512
c46f80e874de972f8f34e175ab607581fa0db7d3a26a64b3c717525c71267a425b6c636ba9423e1c9b3aad81456bedfe7358645650f391df1cf158dc377588f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe

Filesize
184KB

MD5
08ceb578d9a14ed7b554ab544bcbb44b

SHA1
7793f7f345e50c8ca3c703102f300a34dc7523ee

SHA256
d63d98a17c405bdfb9c8da460bc8706e0b841ff56dc740e5b18d5cbe6dbabd31

SHA512
c46f80e874de972f8f34e175ab607581fa0db7d3a26a64b3c717525c71267a425b6c636ba9423e1c9b3aad81456bedfe7358645650f391df1cf158dc377588f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe

Filesize
184KB

MD5
08ceb578d9a14ed7b554ab544bcbb44b

SHA1
7793f7f345e50c8ca3c703102f300a34dc7523ee

SHA256
d63d98a17c405bdfb9c8da460bc8706e0b841ff56dc740e5b18d5cbe6dbabd31

SHA512
c46f80e874de972f8f34e175ab607581fa0db7d3a26a64b3c717525c71267a425b6c636ba9423e1c9b3aad81456bedfe7358645650f391df1cf158dc377588f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe

Filesize
184KB

MD5
8da44d7f405507d9e4fce21c16fa602c

SHA1
d83d6668b9eba5f1d84eadd36aa1dbebaec2f536

SHA256
b3ba959ed97a7c06bba83c70b67cd4a1fff2e1e24625a253cd4b713119a5b7ec

SHA512
b12771346f127c6c1a514b5bb8d8d2ad7581cf479a46756adcccc6807408b34e35f3bd80ad101d30ee6ff116f726258737df9ebc6f7bc408befb149c30986688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe

Filesize
184KB

MD5
8da44d7f405507d9e4fce21c16fa602c

SHA1
d83d6668b9eba5f1d84eadd36aa1dbebaec2f536

SHA256
b3ba959ed97a7c06bba83c70b67cd4a1fff2e1e24625a253cd4b713119a5b7ec

SHA512
b12771346f127c6c1a514b5bb8d8d2ad7581cf479a46756adcccc6807408b34e35f3bd80ad101d30ee6ff116f726258737df9ebc6f7bc408befb149c30986688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe

Filesize
184KB

MD5
e66eb18c2ea7c72a7caf7d4dd407d673

SHA1
463e57a2ccbbf6c88cc32a9e0da22ad3f36fda50

SHA256
fa6c513f5c90d97fb5263dfc63dea5dd54d763253a7ab0f141fa766c85527dab

SHA512
6dca64c0e873d5e773818553501f5213da67190c25a08a13b92f2dfa51713fa932d5cbd63e0a1c466d9286cb67edcf02f1140f0bda71b8976ff550e3795ef5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe

Filesize
184KB

MD5
e66eb18c2ea7c72a7caf7d4dd407d673

SHA1
463e57a2ccbbf6c88cc32a9e0da22ad3f36fda50

SHA256
fa6c513f5c90d97fb5263dfc63dea5dd54d763253a7ab0f141fa766c85527dab

SHA512
6dca64c0e873d5e773818553501f5213da67190c25a08a13b92f2dfa51713fa932d5cbd63e0a1c466d9286cb67edcf02f1140f0bda71b8976ff550e3795ef5f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe

Filesize
184KB

MD5
fb1a5d3099f69e95fd0c470f0697ae66

SHA1
4736ddf4ecd1f8d970912309ab8a1d36a048402d

SHA256
fae69495e856318da3c77121c6cef2fa48e3534231d379b4ae912240b5ccfa37

SHA512
f8f9d149c90b692ba6e84769d123970486751b5b0b2817be4910087b44cd550c4a7be87475bd8920c53d90b5d00d60110d6d53f70f588c9e7e6d46788c158218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe

Filesize
184KB

MD5
fb1a5d3099f69e95fd0c470f0697ae66

SHA1
4736ddf4ecd1f8d970912309ab8a1d36a048402d

SHA256
fae69495e856318da3c77121c6cef2fa48e3534231d379b4ae912240b5ccfa37

SHA512
f8f9d149c90b692ba6e84769d123970486751b5b0b2817be4910087b44cd550c4a7be87475bd8920c53d90b5d00d60110d6d53f70f588c9e7e6d46788c158218

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads