9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0

Analysis

max time kernel
155s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe
Size

468KB
MD5

b3307cda92400c0f9109ba18739a1089
SHA1

a7e0e79bc9f20542b450686f78174e913a247da6
SHA256

9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0
SHA512

01ba25bcf6bb5700408484012ebdee55e13518ca7d74d6b1e6772e6c89ba9db78f1ce28336cdf8fc95855595c2748effd7d0e0ac6bbe5dc9ed395cc87daa6177
SSDEEP

3072:tbACog5dP08U1bY0Pzijff8/EChjt4pCndHeZVpI1i63HlpNjclL:tb1om5U13PejffQEB21iYFpNj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 28 IoCs

Processes:

Unicorn-30590.exeUnicorn-51201.exeUnicorn-27256.exeUnicorn-55714.exeUnicorn-51582.exeUnicorn-60731.exeUnicorn-40865.exeUnicorn-36350.exeUnicorn-54824.exeUnicorn-10112.exeUnicorn-60216.exeUnicorn-40350.exeUnicorn-9213.exeUnicorn-5409.exeUnicorn-2109.exeUnicorn-3069.exeUnicorn-3069.exeUnicorn-40184.exeUnicorn-26151.exeUnicorn-57058.exeUnicorn-19643.exeUnicorn-29371.exeUnicorn-11773.exeUnicorn-48229.exeUnicorn-31207.exeUnicorn-46392.exeUnicorn-46392.exeUnicorn-46392.exe

pid	process
4452	Unicorn-30590.exe
1388	Unicorn-51201.exe
3368	Unicorn-27256.exe
4164	Unicorn-55714.exe
4912	Unicorn-51582.exe
2032	Unicorn-60731.exe
2984	Unicorn-40865.exe
3504	Unicorn-36350.exe
2572	Unicorn-54824.exe
4656	Unicorn-10112.exe
4520	Unicorn-60216.exe
4636	Unicorn-40350.exe
1400	Unicorn-9213.exe
1568	Unicorn-5409.exe
1232	Unicorn-2109.exe
4512	Unicorn-3069.exe
1800	Unicorn-3069.exe
4908	Unicorn-40184.exe
4692	Unicorn-26151.exe
3916	Unicorn-57058.exe
2832	Unicorn-19643.exe
4468	Unicorn-29371.exe
1628	Unicorn-11773.exe
1508	Unicorn-48229.exe
3484	Unicorn-31207.exe
4164	Unicorn-46392.exe
1840	Unicorn-46392.exe
3644	Unicorn-46392.exe

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1368	4452	WerFault.exe	Unicorn-30590.exe
4312	3488	WerFault.exe	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe
408	1388	WerFault.exe	Unicorn-51201.exe
4236	3368	WerFault.exe	Unicorn-27256.exe
3492	3488	WerFault.exe	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe
2040	3504	WerFault.exe	Unicorn-36350.exe
1052	1388	WerFault.exe	Unicorn-51201.exe
2804	3368	WerFault.exe	Unicorn-27256.exe
3068	1800	WerFault.exe	Unicorn-3069.exe
2844	4512	WerFault.exe	Unicorn-3069.exe
1928	3504	WerFault.exe	Unicorn-36350.exe
4420	1400	WerFault.exe	Unicorn-9213.exe
5824	1232	WerFault.exe	Unicorn-2109.exe
5948	1396	WerFault.exe	Unicorn-414.exe
6052	4904	WerFault.exe	Unicorn-38177.exe
5228	4900	WerFault.exe	Unicorn-4211.exe
4948	1628	WerFault.exe	Unicorn-11773.exe
3356	2560	WerFault.exe	Unicorn-62769.exe
6056	1232	WerFault.exe	Unicorn-2109.exe
6248	5192	WerFault.exe	Unicorn-42612.exe
6240	3444	WerFault.exe	Unicorn-50683.exe
6220	3380	WerFault.exe	Unicorn-52596.exe
6588	5236	WerFault.exe	Unicorn-43188.exe
3416	1052	WerFault.exe	Unicorn-5011.exe
6668	5288	WerFault.exe	Unicorn-26193.exe
3992	5232	WerFault.exe	Unicorn-43214.exe
7360	4484	WerFault.exe	Unicorn-13261.exe
7404	5484	WerFault.exe	Unicorn-17614.exe
7476	4692	WerFault.exe	Unicorn-34708.exe
7468	756	WerFault.exe	Unicorn-1360.exe
7432	5156	WerFault.exe	Unicorn-49300.exe
7556	4896	WerFault.exe	Unicorn-15475.exe
7356	5840	WerFault.exe	Unicorn-61588.exe
7340	5044	WerFault.exe	Unicorn-7728.exe
7720	6164	WerFault.exe	Unicorn-29009.exe
8072	5300	WerFault.exe	Unicorn-33265.exe
5680	4024	WerFault.exe	Unicorn-65486.exe
7176	5980	WerFault.exe	Unicorn-16244.exe
7352	5624	WerFault.exe	Unicorn-43482.exe
7328	5920	WerFault.exe	Unicorn-49812.exe
7384	6092	WerFault.exe	Unicorn-23476.exe
7640	5444	WerFault.exe	Unicorn-24436.exe
4384	1932	WerFault.exe	Unicorn-50068.exe
6380	5548	WerFault.exe	Unicorn-52273.exe
8152	2424	WerFault.exe	Unicorn-1360.exe
5596	1168	WerFault.exe	Unicorn-53073.exe
8124	5684	WerFault.exe	Unicorn-50068.exe
6868	1988	WerFault.exe	Unicorn-40497.exe
5616	5332	WerFault.exe	Unicorn-53710.exe
7248	6060	WerFault.exe	Unicorn-43569.exe
6020	6016	WerFault.exe	Unicorn-18417.exe
7116	5144	WerFault.exe	Unicorn-8240.exe
7108	4720	WerFault.exe	Unicorn-59828.exe
7920	4516	WerFault.exe	Unicorn-18126.exe
7492	5876	WerFault.exe	Unicorn-8432.exe
7772	5936	WerFault.exe	Unicorn-43482.exe
8424	3552	WerFault.exe	Unicorn-20753.exe
8328	5752	WerFault.exe	Unicorn-63127.exe
4936	2536	WerFault.exe	Unicorn-6896.exe
5952	2844	WerFault.exe	Unicorn-8240.exe
3512	6176	WerFault.exe	Unicorn-43700.exe
7956	6188	WerFault.exe	Unicorn-11411.exe
7684	4628	WerFault.exe	Unicorn-8240.exe
6636	5916	WerFault.exe	Unicorn-62158.exe

Suspicious use of SetWindowsHookEx 29 IoCs

Processes:

9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exeUnicorn-30590.exeUnicorn-51201.exeUnicorn-55714.exeUnicorn-27256.exeUnicorn-51582.exeUnicorn-60731.exeUnicorn-40865.exeUnicorn-10112.exeUnicorn-36350.exeUnicorn-54824.exeUnicorn-60216.exeUnicorn-40350.exeUnicorn-9213.exeUnicorn-5409.exeUnicorn-3069.exeUnicorn-3069.exeUnicorn-2109.exeUnicorn-40184.exeUnicorn-26151.exeUnicorn-57058.exeUnicorn-19643.exeUnicorn-29371.exeUnicorn-11773.exeUnicorn-31207.exeUnicorn-48229.exeUnicorn-46392.exeUnicorn-46392.exeUnicorn-46392.exe

pid	process
3488	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe
4452	Unicorn-30590.exe
1388	Unicorn-51201.exe
4164	Unicorn-55714.exe
3368	Unicorn-27256.exe
4912	Unicorn-51582.exe
2032	Unicorn-60731.exe
2984	Unicorn-40865.exe
4656	Unicorn-10112.exe
3504	Unicorn-36350.exe
2572	Unicorn-54824.exe
4520	Unicorn-60216.exe
4636	Unicorn-40350.exe
1400	Unicorn-9213.exe
1568	Unicorn-5409.exe
1800	Unicorn-3069.exe
4512	Unicorn-3069.exe
1232	Unicorn-2109.exe
4908	Unicorn-40184.exe
4692	Unicorn-26151.exe
3916	Unicorn-57058.exe
2832	Unicorn-19643.exe
4468	Unicorn-29371.exe
1628	Unicorn-11773.exe
3484	Unicorn-31207.exe
1508	Unicorn-48229.exe
4164	Unicorn-46392.exe
1840	Unicorn-46392.exe
3644	Unicorn-46392.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 3488 wrote to memory of 4452	3488	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe	Unicorn-30590.exe
PID 3488 wrote to memory of 4452	3488	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe	Unicorn-30590.exe
PID 3488 wrote to memory of 4452	3488	9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe	Unicorn-30590.exe
PID 4452 wrote to memory of 1388	4452	Unicorn-30590.exe	Unicorn-51201.exe
PID 4452 wrote to memory of 1388	4452	Unicorn-30590.exe	Unicorn-51201.exe
PID 4452 wrote to memory of 1388	4452	Unicorn-30590.exe	Unicorn-51201.exe
PID 1388 wrote to memory of 3368	1388	Unicorn-51201.exe	Unicorn-27256.exe
PID 1388 wrote to memory of 3368	1388	Unicorn-51201.exe	Unicorn-27256.exe
PID 1388 wrote to memory of 3368	1388	Unicorn-51201.exe	Unicorn-27256.exe
PID 4452 wrote to memory of 4164	4452	Unicorn-30590.exe	Unicorn-55714.exe
PID 4452 wrote to memory of 4164	4452	Unicorn-30590.exe	Unicorn-55714.exe
PID 4452 wrote to memory of 4164	4452	Unicorn-30590.exe	Unicorn-55714.exe
PID 4164 wrote to memory of 4912	4164	Unicorn-55714.exe	Unicorn-51582.exe
PID 4164 wrote to memory of 4912	4164	Unicorn-55714.exe	Unicorn-51582.exe
PID 4164 wrote to memory of 4912	4164	Unicorn-55714.exe	Unicorn-51582.exe
PID 3368 wrote to memory of 2032	3368	Unicorn-27256.exe	Unicorn-60731.exe
PID 3368 wrote to memory of 2032	3368	Unicorn-27256.exe	Unicorn-60731.exe
PID 3368 wrote to memory of 2032	3368	Unicorn-27256.exe	Unicorn-60731.exe
PID 1388 wrote to memory of 2984	1388	Unicorn-51201.exe	Unicorn-40865.exe
PID 1388 wrote to memory of 2984	1388	Unicorn-51201.exe	Unicorn-40865.exe
PID 1388 wrote to memory of 2984	1388	Unicorn-51201.exe	Unicorn-40865.exe
PID 4912 wrote to memory of 3504	4912	Unicorn-51582.exe	Unicorn-36350.exe
PID 4912 wrote to memory of 3504	4912	Unicorn-51582.exe	Unicorn-36350.exe
PID 4912 wrote to memory of 3504	4912	Unicorn-51582.exe	Unicorn-36350.exe
PID 4164 wrote to memory of 2572	4164	Unicorn-55714.exe	Unicorn-54824.exe
PID 4164 wrote to memory of 2572	4164	Unicorn-55714.exe	Unicorn-54824.exe
PID 4164 wrote to memory of 2572	4164	Unicorn-55714.exe	Unicorn-54824.exe
PID 2032 wrote to memory of 4656	2032	Unicorn-60731.exe	Unicorn-10112.exe
PID 2032 wrote to memory of 4656	2032	Unicorn-60731.exe	Unicorn-10112.exe
PID 2032 wrote to memory of 4656	2032	Unicorn-60731.exe	Unicorn-10112.exe
PID 2984 wrote to memory of 4520	2984	Unicorn-40865.exe	Unicorn-60216.exe
PID 2984 wrote to memory of 4520	2984	Unicorn-40865.exe	Unicorn-60216.exe
PID 2984 wrote to memory of 4520	2984	Unicorn-40865.exe	Unicorn-60216.exe
PID 3368 wrote to memory of 4636	3368	Unicorn-27256.exe	Unicorn-40350.exe
PID 3368 wrote to memory of 4636	3368	Unicorn-27256.exe	Unicorn-40350.exe
PID 3368 wrote to memory of 4636	3368	Unicorn-27256.exe	Unicorn-40350.exe
PID 3504 wrote to memory of 1400	3504	Unicorn-36350.exe	Unicorn-9213.exe
PID 3504 wrote to memory of 1400	3504	Unicorn-36350.exe	Unicorn-9213.exe
PID 3504 wrote to memory of 1400	3504	Unicorn-36350.exe	Unicorn-9213.exe
PID 4912 wrote to memory of 1568	4912	Unicorn-51582.exe	Unicorn-5409.exe
PID 4912 wrote to memory of 1568	4912	Unicorn-51582.exe	Unicorn-5409.exe
PID 4912 wrote to memory of 1568	4912	Unicorn-51582.exe	Unicorn-5409.exe
PID 4656 wrote to memory of 1232	4656	Unicorn-10112.exe	Unicorn-2109.exe
PID 4656 wrote to memory of 1232	4656	Unicorn-10112.exe	Unicorn-2109.exe
PID 4656 wrote to memory of 1232	4656	Unicorn-10112.exe	Unicorn-2109.exe
PID 4520 wrote to memory of 4512	4520	Unicorn-60216.exe	Unicorn-3069.exe
PID 4520 wrote to memory of 4512	4520	Unicorn-60216.exe	Unicorn-3069.exe
PID 4520 wrote to memory of 4512	4520	Unicorn-60216.exe	Unicorn-3069.exe
PID 4636 wrote to memory of 1800	4636	Unicorn-40350.exe	Unicorn-3069.exe
PID 4636 wrote to memory of 1800	4636	Unicorn-40350.exe	Unicorn-3069.exe
PID 4636 wrote to memory of 1800	4636	Unicorn-40350.exe	Unicorn-3069.exe
PID 2572 wrote to memory of 4908	2572	Unicorn-54824.exe	Unicorn-40184.exe
PID 2572 wrote to memory of 4908	2572	Unicorn-54824.exe	Unicorn-40184.exe
PID 2572 wrote to memory of 4908	2572	Unicorn-54824.exe	Unicorn-40184.exe
PID 2984 wrote to memory of 4692	2984	Unicorn-40865.exe	Unicorn-26151.exe
PID 2984 wrote to memory of 4692	2984	Unicorn-40865.exe	Unicorn-26151.exe
PID 2984 wrote to memory of 4692	2984	Unicorn-40865.exe	Unicorn-26151.exe
PID 3504 wrote to memory of 3916	3504	Unicorn-36350.exe	Unicorn-57058.exe
PID 3504 wrote to memory of 3916	3504	Unicorn-36350.exe	Unicorn-57058.exe
PID 3504 wrote to memory of 3916	3504	Unicorn-36350.exe	Unicorn-57058.exe
PID 1400 wrote to memory of 2832	1400	Unicorn-9213.exe	Unicorn-19643.exe
PID 1400 wrote to memory of 2832	1400	Unicorn-9213.exe	Unicorn-19643.exe
PID 1400 wrote to memory of 2832	1400	Unicorn-9213.exe	Unicorn-19643.exe
PID 1800 wrote to memory of 4468	1800	Unicorn-3069.exe	Unicorn-29371.exe

C:\Users\Admin\AppData\Local\Temp\9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe
"C:\Users\Admin\AppData\Local\Temp\9f48bb3213652848914631fdff81adf27f7b0a4a2b373f9af0fa8c8ef4f51af0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656

C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1232

C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3644

C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
9⤵
PID:3120

C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
10⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45041.exe
11⤵
PID:5804

C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
12⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
13⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30391.exe
14⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
15⤵
PID:5672

C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
16⤵
PID:1072

C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2454.exe
17⤵
PID:8832

C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16340.exe
18⤵
PID:7000

C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
19⤵
PID:9524

C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
20⤵
PID:6496

C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
21⤵
PID:10528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8832 -s 752
18⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 764
17⤵
PID:9756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 756
16⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 756
15⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 756
15⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 764
14⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 760
13⤵
- Program crash
PID:8152

C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
8⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
9⤵
PID:3320

C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
10⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
11⤵
PID:5144

C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
12⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
13⤵
PID:4380

C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
14⤵
PID:7256

C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16535.exe
15⤵
PID:7004

C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
16⤵
PID:8604

C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
17⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
18⤵
PID:9252

C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
19⤵
PID:10056

C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
20⤵
PID:10620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8604 -s 764
17⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 764
16⤵
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 844
15⤵
PID:9872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 848
14⤵
PID:8588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 756
13⤵
- Program crash
PID:8328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 832
12⤵
- Program crash
PID:7116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 764
11⤵
- Program crash
PID:7556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 756
8⤵
- Program crash
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 756
8⤵
- Program crash
PID:6056

C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636

C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800

C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
8⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
9⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6291.exe
10⤵
PID:5676

C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
11⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
12⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16686.exe
13⤵
PID:6632

C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
14⤵
PID:4468

C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
15⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
16⤵
PID:8564

C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
17⤵
PID:6044

C:\Users\Admin\AppData\Local\Temp\Unicorn-42638.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42638.exe
18⤵
PID:9224

C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
19⤵
PID:9388

C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53751.exe
20⤵
PID:10416

C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7475.exe
21⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 764
18⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8564 -s 756
17⤵
PID:10332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 764
14⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 764
13⤵
- Program crash
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 764
12⤵
- Program crash
PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 840
9⤵
- Program crash
PID:5228

C:\Users\Admin\AppData\Local\Temp\Unicorn-3703.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3703.exe
8⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
9⤵
PID:5692

C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
10⤵
PID:5880

C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
11⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
12⤵
PID:6760

C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
13⤵
PID:1528

C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62647.exe
14⤵
PID:7752

C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
15⤵
PID:8472

C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41358.exe
16⤵
PID:8804

C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
17⤵
PID:9428

C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62263.exe
18⤵
PID:5772

C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
19⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8472 -s 828
16⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1943.exe
7⤵
PID:2652

C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
8⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
9⤵
PID:3380

C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
10⤵
PID:5548

C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
11⤵
PID:4024

C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
12⤵
PID:6032

C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
13⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34967.exe
14⤵
PID:7632

C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
15⤵
PID:8464

C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64855.exe
16⤵
PID:8004

C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
17⤵
PID:9436

C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
18⤵
PID:9416

C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
19⤵
PID:10644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8464 -s 756
16⤵
PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 764
15⤵
PID:7456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 756
14⤵
PID:9308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 764
13⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 764
13⤵
PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 756
12⤵
- Program crash
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 796
11⤵
- Program crash
PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 844
10⤵
- Program crash
PID:6220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 852
9⤵
- Program crash
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 740
7⤵
- Program crash
PID:3068

C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1508

C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
7⤵
PID:2468

C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5011.exe
8⤵
PID:1052

C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
9⤵
PID:3552

C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
10⤵
PID:6060

C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
11⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
12⤵
PID:7152

C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19383.exe
13⤵
PID:6580

C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
14⤵
PID:8160

C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
15⤵
PID:8544

C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
16⤵
PID:9056

C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
17⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
18⤵
PID:10036

C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
19⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
20⤵
PID:10628

C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
17⤵
PID:10084

C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
18⤵
PID:4084

C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
19⤵
PID:10636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8544 -s 756
16⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8160 -s 848
15⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 844
14⤵
PID:9300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 840
13⤵
PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 764
12⤵
PID:7416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 760
11⤵
- Program crash
PID:7248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 748
10⤵
- Program crash
PID:8424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 756
9⤵
- Program crash
PID:3416

C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
7⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
8⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
9⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
10⤵
PID:3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
11⤵
PID:7092

C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
12⤵
PID:7788

C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50129.exe
13⤵
PID:8364

C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
14⤵
PID:6676

C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
15⤵
PID:8932

C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63479.exe
16⤵
PID:10080

C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39342.exe
17⤵
PID:9476

C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26030.exe
18⤵
PID:10736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6676 -s 852
15⤵
PID:11004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8364 -s 756
14⤵
PID:8884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 828
13⤵
PID:10144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 756
12⤵
PID:9364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 764
11⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 848
10⤵
- Program crash
PID:7772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 852
9⤵
- Program crash
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 840
5⤵
- Program crash
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 836
5⤵
- Program crash
PID:2804

C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\Unicorn-60216.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60216.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4512

C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
7⤵
PID:4904

C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7984.exe
8⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
9⤵
PID:5232

C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
10⤵
PID:1932

C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8240.exe
11⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25207.exe
12⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
13⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\Unicorn-25751.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25751.exe
14⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
15⤵
PID:8556

C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
15⤵
PID:6988

C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
16⤵
PID:6444

C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
17⤵
PID:9456

C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
18⤵
PID:10116

C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34670.exe
19⤵
PID:10652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 824
12⤵
- Program crash
PID:7684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 764
11⤵
- Program crash
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 764
10⤵
- Program crash
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 852
8⤵
- Program crash
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 756
7⤵
- Program crash
PID:2844

C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
7⤵
PID:316

C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
8⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
9⤵
PID:3640

C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-1360.exe
10⤵
PID:756

C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
11⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
12⤵
PID:6832

C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
13⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
14⤵
PID:5508

C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
15⤵
PID:8680

C:\Users\Admin\AppData\Local\Temp\Unicorn-11885.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11885.exe
16⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15927.exe
17⤵
PID:8196

C:\Users\Admin\AppData\Local\Temp\Unicorn-39636.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39636.exe
18⤵
PID:10432

C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14704.exe
19⤵
PID:10920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 756
16⤵
PID:11020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 764
15⤵
PID:6384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 756
14⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 764
13⤵
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 764
12⤵
- Program crash
PID:7108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 852
11⤵
- Program crash
PID:7468

C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Users\Admin\AppData\Local\Temp\Unicorn-11773.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11773.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628

C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25649.exe
7⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\Unicorn-23569.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23569.exe
8⤵
PID:416

C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
9⤵
PID:5288

C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
10⤵
PID:5852

C:\Users\Admin\AppData\Local\Temp\Unicorn-49812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49812.exe
11⤵
PID:5920

C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
12⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 852
12⤵
- Program crash
PID:7328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 844
10⤵
- Program crash
PID:6668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 844
10⤵
PID:7348

C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
7⤵
PID:3444

C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36020.exe
8⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23476.exe
9⤵
PID:6092

C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29009.exe
10⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6164 -s 716
11⤵
- Program crash
PID:7720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 852
10⤵
- Program crash
PID:7384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 756
8⤵
- Program crash
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 844
7⤵
- Program crash
PID:4948

C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
6⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\Unicorn-49659.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49659.exe
7⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33265.exe
8⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
9⤵
PID:5916

C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
10⤵
PID:6756

C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
11⤵
PID:6276

C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
12⤵
PID:7840

C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
13⤵
PID:8456

C:\Users\Admin\AppData\Local\Temp\Unicorn-6422.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6422.exe
14⤵
PID:6744

C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
15⤵
PID:9204

C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
16⤵
PID:10104

C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41239.exe
17⤵
PID:8060

C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
18⤵
PID:11044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 764
15⤵
PID:10872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8456 -s 852
14⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 840
13⤵
PID:9004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 752
12⤵
PID:9284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 764
11⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 756
10⤵
- Program crash
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 756
9⤵
- Program crash
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 844
8⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 840
4⤵
- Program crash
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 860
4⤵
- Program crash
PID:1052

C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164

C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912

C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
8⤵
PID:3124

C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4144.exe
9⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10899.exe
10⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
11⤵
PID:5624

C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
12⤵
PID:6176

C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44558.exe
13⤵
PID:4884

C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55534.exe
14⤵
PID:3128

C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21911.exe
15⤵
PID:8140

C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8077.exe
16⤵
PID:9136

C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3501.exe
17⤵
PID:8000

C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12534.exe
18⤵
PID:9392

C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
19⤵
PID:7724

C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
20⤵
PID:10668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 756
18⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9136 -s 756
17⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 756
16⤵
PID:9972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 764
15⤵
PID:9940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 760
14⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 740
13⤵
- Program crash
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 736
12⤵
- Program crash
PID:7352

C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34522.exe
8⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
9⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
10⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
11⤵
PID:6224

C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39831.exe
12⤵
PID:5884

C:\Users\Admin\AppData\Local\Temp\Unicorn-59601.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59601.exe
13⤵
PID:8184

C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30327.exe
14⤵
PID:8956

C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10963.exe
15⤵
PID:8840

C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
16⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-6845.exe
17⤵
PID:9488

C:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exe
18⤵
PID:10496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8840 -s 756
16⤵
PID:8116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8956 -s 844
15⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8184 -s 764
14⤵
PID:7556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 756
13⤵
PID:9804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6224 -s 740
12⤵
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 824
11⤵
- Program crash
PID:8124

C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
7⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
8⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49332.exe
9⤵
PID:1528

C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46129.exe
10⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\Unicorn-40497.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40497.exe
11⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
12⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 764
12⤵
- Program crash
PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 768
8⤵
- Program crash
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 832
7⤵
- Program crash
PID:4420

C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3916

C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
7⤵
PID:4036

C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
8⤵
PID:4380

C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42612.exe
9⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61588.exe
10⤵
PID:5840

C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
11⤵
PID:5444

C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
12⤵
PID:6188

C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
13⤵
PID:3612

C:\Users\Admin\AppData\Local\Temp\Unicorn-22481.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22481.exe
14⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
15⤵
PID:3520

C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
16⤵
PID:8732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 756
16⤵
PID:10152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 852
15⤵
PID:9316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 844
14⤵
PID:8596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 756
13⤵
- Program crash
PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 764
12⤵
- Program crash
PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 852
11⤵
- Program crash
PID:7356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 756
10⤵
- Program crash
PID:6248

C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54424.exe
7⤵
PID:4012

C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43188.exe
8⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21329.exe
9⤵
PID:5536

C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
10⤵
PID:4516

C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
11⤵
PID:6412

C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
12⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
13⤵
PID:7588

C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
14⤵
PID:8820

C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
15⤵
PID:8128

C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17719.exe
16⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
17⤵
PID:9532

C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51255.exe
18⤵
PID:10512

C:\Users\Admin\AppData\Local\Temp\Unicorn-19220.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19220.exe
19⤵
PID:11148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 844
16⤵
PID:11028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8820 -s 852
15⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 852
14⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 852
13⤵
PID:9864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 756
12⤵
PID:8920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 852
11⤵
- Program crash
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 756
9⤵
- Program crash
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 756
9⤵
PID:8896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 844
6⤵
- Program crash
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 844
6⤵
- Program crash
PID:1928

C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1568

C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
7⤵
PID:5096

C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39630.exe
8⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39473.exe
9⤵
PID:6040

C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
10⤵
PID:1168

C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
11⤵
PID:1492

C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18295.exe
12⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
13⤵
PID:7776

C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
14⤵
PID:8348

C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-65047.exe
15⤵
PID:9212

C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
16⤵
PID:9444

C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
17⤵
PID:9328

C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
18⤵
PID:10568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8348 -s 844
15⤵
PID:7188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7776 -s 764
14⤵
PID:7344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 764
13⤵
PID:9292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 764
12⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 764
11⤵
- Program crash
PID:5596

C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57496.exe
6⤵
PID:5048

C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
7⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
8⤵
PID:6072

C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49300.exe
9⤵
PID:5156

C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
10⤵
PID:6016

C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49079.exe
11⤵
PID:6640

C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
12⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28055.exe
13⤵
PID:7800

C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
14⤵
PID:8012

C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
15⤵
PID:6232

C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-9939.exe
16⤵
PID:6976

C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
17⤵
PID:10096

C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
18⤵
PID:4548

C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24276.exe
19⤵
PID:10688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 852
16⤵
PID:10840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 844
15⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 844
14⤵
PID:10160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 756
13⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 852
12⤵
PID:9188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 848
11⤵
- Program crash
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5156 -s 844
10⤵
- Program crash
PID:7432

C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572

C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36500.exe
7⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51441.exe
8⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
9⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
10⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
11⤵
PID:5332

C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
12⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
13⤵
PID:5996

C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11230.exe
14⤵
PID:7576

C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64846.exe
15⤵
PID:8208

C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
16⤵
PID:6400

C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-18487.exe
17⤵
PID:5948

C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8438.exe
18⤵
PID:9616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 844
17⤵
PID:10916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 764
16⤵
PID:7228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 756
15⤵
PID:9248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 756
14⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 752
13⤵
PID:8912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 760
12⤵
- Program crash
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 764
11⤵
- Program crash
PID:7476

C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37594.exe
6⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7728.exe
7⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17614.exe
8⤵
PID:5484

C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
9⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
10⤵
PID:952

C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
11⤵
PID:6624

C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
12⤵
PID:7976

C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10134.exe
13⤵
PID:8576

C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
14⤵
PID:6248

C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
15⤵
PID:7104

C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61495.exe
16⤵
PID:10124

C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
17⤵
PID:10448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 728
14⤵
PID:10272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7976 -s 844
13⤵
PID:7504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 764
12⤵
PID:9656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 764
11⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 764
10⤵
- Program crash
PID:7492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 764
9⤵
- Program crash
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 764
8⤵
- Program crash
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 848
3⤵
- Program crash
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 848
2⤵
- Program crash
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 848
2⤵
- Program crash
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3488 -ip 3488
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4452 -ip 4452
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1388 -ip 1388
1⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3368 -ip 3368
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4164 -ip 4164
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4164 -ip 4164
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2032 -ip 2032
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2032 -ip 2032
1⤵
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2984 -ip 2984
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4912 -ip 4912
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2984 -ip 2984
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4912 -ip 4912
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3488 -ip 3488
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4452 -ip 4452
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3368 -ip 3368
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1388 -ip 1388
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4656 -ip 4656
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3504 -ip 3504
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4656 -ip 4656
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2572 -ip 2572
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4520 -ip 4520
1⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2572 -ip 2572
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4636 -ip 4636
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4520 -ip 4520
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1400 -ip 1400
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4636 -ip 4636
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1400 -ip 1400
1⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3504 -ip 3504
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1800 -ip 1800
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4512 -ip 4512
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4908 -ip 4908
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3484 -ip 3484
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1568 -ip 1568
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4908 -ip 4908
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4164 -ip 4164
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3484 -ip 3484
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4692 -ip 4692
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1568 -ip 1568
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4164 -ip 4164
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4692 -ip 4692
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1840 -ip 1840
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3644 -ip 3644
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1840 -ip 1840
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3644 -ip 3644
1⤵
PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1232 -ip 1232
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2832 -ip 2832
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1396 -ip 1396
1⤵
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3124 -ip 3124
1⤵
PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4904 -ip 4904
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3916 -ip 3916
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2652 -ip 2652
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4036 -ip 4036
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4900 -ip 4900
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4468 -ip 4468
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3580 -ip 3580
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2832 -ip 2832
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3120 -ip 3120
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1800 -ip 1800
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3124 -ip 3124
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3916 -ip 3916
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2652 -ip 2652
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5096 -ip 5096
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4036 -ip 4036
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4512 -ip 4512
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1508 -ip 1508
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1364 -ip 1364
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3580 -ip 3580
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5048 -ip 5048
1⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3120 -ip 3120
1⤵
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 316 -ip 316
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5096 -ip 5096
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1628 -ip 1628
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1508 -ip 1508
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1364 -ip 1364
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2468 -ip 2468
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5048 -ip 5048
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 316 -ip 316
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4012 -ip 4012
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2560 -ip 2560
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1232 -ip 1232
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2396 -ip 2396
1⤵
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4544 -ip 4544
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1256 -ip 1256
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3392 -ip 3392
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1804 -ip 1804
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5040 -ip 5040
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3956 -ip 3956
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4284 -ip 4284
1⤵
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1788 -ip 1788
1⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4992 -ip 4992
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 740 -ip 740
1⤵
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4380 -ip 4380
1⤵
PID:5644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 436 -ip 436
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2468 -ip 2468
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 416 -ip 416
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 508 -ip 508
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4696 -ip 4696
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4012 -ip 4012
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1396 -ip 1396
1⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4904 -ip 4904
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1528 -ip 1528
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4408 -ip 4408
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3380 -ip 3380
1⤵
PID:6292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3444 -ip 3444
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5192 -ip 5192
1⤵
PID:6428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5288 -ip 5288
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1052 -ip 1052
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5236 -ip 5236
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4544 -ip 4544
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2396 -ip 2396
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1256 -ip 1256
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3392 -ip 3392
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 1804 -ip 1804
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1788 -ip 1788
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4284 -ip 4284
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3956 -ip 3956
1⤵
PID:6568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 436 -ip 436
1⤵
PID:6292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6072 -ip 6072
1⤵
PID:6732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5040 -ip 5040
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4380 -ip 4380
1⤵
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 408 -ip 408
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4696 -ip 4696
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 508 -ip 508
1⤵
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 416 -ip 416
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6148 -ip 6148
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1528 -ip 1528
1⤵
PID:6700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4408 -ip 4408
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5904 -ip 5904
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5676 -ip 5676
1⤵
PID:6620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5536 -ip 5536
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5232 -ip 5232
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5548 -ip 5548
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3552 -ip 3552
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5692 -ip 5692
1⤵
PID:6432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5664 -ip 5664
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3320 -ip 3320
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4436 -ip 4436
1⤵
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 4312 -ip 4312
1⤵
PID:6620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3640 -ip 3640
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 5804 -ip 5804
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6040 -ip 6040
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5564 -ip 5564
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5852 -ip 5852
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5248 -ip 5248
1⤵
PID:6300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5044 -ip 5044
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5840 -ip 5840
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4484 -ip 4484
1⤵
PID:6268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 5484 -ip 5484
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 5156 -ip 5156
1⤵
PID:7208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 756 -ip 756
1⤵
PID:7276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4692 -ip 4692
1⤵
PID:7324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6072 -ip 6072
1⤵
PID:7416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 408 -ip 408
1⤵
PID:7424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 4896 -ip 4896
1⤵
PID:7484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6164 -ip 6164
1⤵
PID:7520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5536 -ip 5536
1⤵
PID:7684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 1628 -ip 1628
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5300 -ip 5300
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5548 -ip 5548
1⤵
PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5980 -ip 5980
1⤵
PID:8120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4024 -ip 4024
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6092 -ip 6092
1⤵
PID:7380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5880 -ip 5880
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5920 -ip 5920
1⤵
PID:7764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5624 -ip 5624
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3552 -ip 3552
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 5444 -ip 5444
1⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2424 -ip 2424
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5664 -ip 5664
1⤵
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 1168 -ip 1168
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 1932 -ip 1932
1⤵
PID:6508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5144 -ip 5144
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 6060 -ip 6060
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1988 -ip 1988
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 5332 -ip 5332
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4516 -ip 4516
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6016 -ip 6016
1⤵
PID:8000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5684 -ip 5684
1⤵
PID:8228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 3320 -ip 3320
1⤵
PID:8240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 4720 -ip 4720
1⤵
PID:8256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4436 -ip 4436
1⤵
PID:8264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 5936 -ip 5936
1⤵
PID:8524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5876 -ip 5876
1⤵
PID:8652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 4312 -ip 4312
1⤵
PID:8744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 5564 -ip 5564
1⤵
PID:8868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 6040 -ip 6040
1⤵
PID:9056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3640 -ip 3640
1⤵
PID:9108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 4064 -ip 4064
1⤵
PID:9176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4344 -ip 4344
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5248 -ip 5248
1⤵
PID:8248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5852 -ip 5852
1⤵
PID:8540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5804 -ip 5804
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 2536 -ip 2536
1⤵
PID:8788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 2844 -ip 2844
1⤵
PID:8148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6176 -ip 6176
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4628 -ip 4628
1⤵
PID:6720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6188 -ip 6188
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5916 -ip 5916
1⤵
PID:8800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5752 -ip 5752
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5072 -ip 5072
1⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6412 -ip 6412
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6032 -ip 6032
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2560 -ip 2560
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6760 -ip 6760
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 952 -ip 952
1⤵
PID:8196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6224 -ip 6224
1⤵
PID:8792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1492 -ip 1492
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3636 -ip 3636
1⤵
PID:8656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4884 -ip 4884
1⤵
PID:8620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2548 -ip 2548
1⤵
PID:7520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6832 -ip 6832
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 6640 -ip 6640
1⤵
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6756 -ip 6756
1⤵
PID:9328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6632 -ip 6632
1⤵
PID:9472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 2116 -ip 2116
1⤵
PID:9572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 4380 -ip 4380
1⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 7152 -ip 7152
1⤵
PID:9672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1328 -p 3612 -ip 3612
1⤵
PID:9988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5220 -ip 5220
1⤵
PID:8108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5996 -ip 5996
1⤵
PID:7220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1356 -p 3444 -ip 3444
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4468 -ip 4468
1⤵
PID:8876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5288 -ip 5288
1⤵
PID:10044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 1052 -ip 1052
1⤵
PID:7432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5236 -ip 5236
1⤵
PID:9576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3380 -ip 3380
1⤵
PID:7668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 6276 -ip 6276
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 5192 -ip 5192
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5476 -ip 5476
1⤵
PID:8876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6580 -ip 6580
1⤵
PID:7468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 3196 -ip 3196
1⤵
PID:7432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5960 -ip 5960
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1312 -p 7092 -ip 7092
1⤵
PID:6388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1528 -ip 1528
1⤵
PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 1900 -ip 1900
1⤵
PID:10388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6624 -ip 6624
1⤵
PID:10584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5672 -ip 5672
1⤵
PID:10852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5884 -ip 5884
1⤵
PID:10860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1216 -ip 1216
1⤵
PID:10964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 7256 -ip 7256
1⤵
PID:11056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6612 -ip 6612
1⤵
PID:11160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1384 -p 3128 -ip 3128
1⤵
PID:8880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 7788 -ip 7788
1⤵
PID:6388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1352 -p 3520 -ip 3520
1⤵
PID:10488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7800 -ip 7800
1⤵
PID:10776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7840 -ip 7840
1⤵
PID:10792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 7576 -ip 7576
1⤵
PID:11172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 7632 -ip 7632
1⤵
PID:11156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 7976 -ip 7976
1⤵
PID:7720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 8160 -ip 8160
1⤵
PID:7824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
Filesize
468KB

MD5
b99d42e27415cc136711176c8b7ef54b

SHA1
e1a078ad8e0f522ba22fc5cf0e00ab73c4a0ad74

SHA256
bb0957e68c5db344eff7dbf6b307e8e8ad7d677aa88b5b7d6a7e948930186489

SHA512
38937f2ae85a812fb2a4169e1ae1d2304bb5a83bb0f2d611ecf424421897333bef51d83dd9dedb66fd1d790f69cb9d3aa5270d81765f3fbb46ae0daf13f8b425

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11773.exe
Filesize
468KB

MD5
5e9a2623554caa7fda7b7175a59cf33c

SHA1
637c80e665530df53d77fa5e7e06c3b3ec1b1352

SHA256
fee93584463a1f9ef264105536716290a0cb0f6bdd891adad4650368f6ac78f1

SHA512
855b3aee3900ca07a560a04e63f5257b70f1197d79a9f4a4ec17215d4e7c162bb32be47d2ef41b883eee7e7f3a175bc009f4f937a490e65380293431133234a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19643.exe
Filesize
468KB

MD5
dec60414df3089b67414fedc826ab1b4

SHA1
91eae3eca3e7968e04ad0dfbff5e50c79eccff1b

SHA256
48b2f5c3f55285c3f039ba37faf55dc9d066975b419ddc09ddb7ee8d4ddcac41

SHA512
9968eb028590ef3b65d81446c7adfc12e1d09522558157c211f62892bc99e9192c29ce4eff50355f0c2e61572e0b6e12b96f08abb984c91cbbbecd5f6f6ee4c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
Filesize
468KB

MD5
653f49dbe4df9d60cbb10e9d3cba860b

SHA1
dc56266946e24d9e0452ebd2dcc5c361926d22ea

SHA256
ec827bbe227b0ac8b3b93aa3294c103c5a41eaedc16bfe3b4253eb79c60b2a2b

SHA512
53001a60250a12b45c5571a93883bc8dd675c94871cdf32c32e57b10534cd0c7d178ee32b954dc4d846b078f8e5c2e1753c9557d536028ac31560765f2c48b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
Filesize
468KB

MD5
179a5bb97f4e98a9d3060ba4838d3068

SHA1
2e249bf73a25fc28febb0e3b1383829505067b00

SHA256
db4686895c4cdd80e4a39c2bbb8b19b773c8734bb69b3112f2ea784e0a84f948

SHA512
f3f5a6dcd9c2ec19df59a91dfc187458c5cbda26176b50b4e21459a5a2076b1696d0e1950983bdb54413c63ba6963b41cbd78f8100705ccf637120d5669b44ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26151.exe
Filesize
468KB

MD5
8149daf2269efaf1c33db9c8bdc119dd

SHA1
4d7ccec8a2c31be3891a8d3bf21a21e9df9a5f01

SHA256
3f035a683f294473aec91459f468bfa51695bbf066dbb66620b90a5757bc8aba

SHA512
40f15ef802c8571a9a6c38bea8d90eed876fe6bfdefb7de534a2f925a9c8d2bc5642d3e759dcb74f69318e82140bcbf7270087db4fee5a82798549ea973c2060

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27256.exe
Filesize
468KB

MD5
0fd7a1e254499313285b7a07d05ffc62

SHA1
9c13f44e7adc71a7d62ef106e7ab15ac058d6484

SHA256
9b24a82df4c4f2aca3967bf3deb0ef965b057612beb1f9d5c662e4081af6b138

SHA512
a857839a256ccd4697014a0c98e7c71ee2625bc16d9af071be4dca98c4ae2b8b3373dbf0461e7727c2ae4fa607965276dd75be653282b3d8d383867967592bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
Filesize
468KB

MD5
4e74022873e24c25c9f6a9e46036b737

SHA1
7d4fb6b45df5a151ac9039e9ddc5c650fd4e498f

SHA256
df7faf68d0bdbd8e64a9c57c12354d14add8347dc8c8f027b27a42a65de117d7

SHA512
35eec7ed9c0599997cbb4b454822f1ab8aabdb3b33e4b5cc6042e6ac5f791ad3d4b1845526ba0be50c8ae63fc5851703c499e5740a102889334190a63167f3d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
Filesize
468KB

MD5
67fce437af118ee4c2f348770d423ba0

SHA1
34ab3105672d4c293aa13003b566ea9eef0aef0f

SHA256
6a5180bb6eb8ea0b84c23d669287dcc27001d46c9272de1575672686fdea5c2e

SHA512
872bc6fa6fd0668635bb88e9fd59755e117a9c1f2085f6995c817534ac7b52c112c144ad534c4170114e4cade1e914cb6f098403c3d56405ed758c835c7ac6c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
Filesize
468KB

MD5
4f4780d59cf14c0a6c8564f262fcd9b6

SHA1
d5722f80e91c2861151645d96b30a23a08a11d54

SHA256
96a22ff42f03ea0e52418f8b045d223ec265c927e9d64f22a166dba3b10af27d

SHA512
147b23c17eb6207a3b27f141225303ceec0ed59f717a0e6624d091428c95e1abb5423d2a2856f8a07d39b818d33fc45f3c689b0fe6daedd977d1c2db76e43a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
Filesize
468KB

MD5
e68b338bfe76177cbf50984416d0f740

SHA1
8ad0d3abc14dcf6eb62ead7b4bfe7a0741defb08

SHA256
96d6383ed2ccda73d9108b6c975a1ad73748c01f44680c9207f77b1d258a188e

SHA512
4b423714a453ff303c5221ff5b97f2ce5d26413b94591b7cb8e8aa922bbd9f141292e2d9cdf0564e5b5de2c3a781e621aef23e4ebef5be26de374a7ed5cf66bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
Filesize
468KB

MD5
33a721712fbac4de693cf76aaecfb735

SHA1
f99eb9b74a2324f647bc110befef9574f687e5a4

SHA256
b8d3a4a2b6b7501542c897d5b9380688e6be95b18cc76a9ce96cc04418da2c0f

SHA512
c66d726722bdc66195546aaa1d0b3bd1f3d73921e5824a12c703edffd04371a9c4b03592a3e4199346cc8f93d8b94da094b72e88a19cf8152ebec6d074e8518b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38177.exe
Filesize
468KB

MD5
5ed6a93db574b5d25dde79965c6350ec

SHA1
57d0f5687abd9bb7e3b9d39357885bb2c66229ae

SHA256
c95f4cc3aac90d1dad862642eba3bc31281c0139d30a36a3d783c26d425ee1bd

SHA512
cb22d04c837abd25e77353f0ccdb4a7e5a90663c909778730444dce7af8771f935ea00e79e3efd358f58e7cd48217ddc72d433f3c5c7fb73ca25a81649745039

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40184.exe
Filesize
468KB

MD5
0d60ff658f6b5375e38e8245dd6a1119

SHA1
25660ce622fab393f023065f2373ea39ba9f72f5

SHA256
c83abd3f09fa9ec6d0e02c86099fa264a150eea41b4fdda2f5a147f3a57b9bbf

SHA512
6dfa993442514967aae6d4510bf457fda71b53220e2ce64b9011e2f84a353e65457afca00378ae5a1410d3702b8ce238a18b61705d259243f11c13ec74705980

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
Filesize
468KB

MD5
b703bef197adf04bfc17253aded3cc29

SHA1
554bfec58f88f0d9d900cb2f8ae9efa5790d3d97

SHA256
188914ec74eaee012db71d7bb777b851b9b63710d6f1c245dbc4726791969c24

SHA512
b5575043d5a3e97c356a6485bc628b3591df1792490c373670daaf735e77adc3c1f52a6e7a547911ba7927463e68594bfadb82acdceb6e700bfd6880e3dde0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
Filesize
468KB

MD5
bd049cbf179440b261f251cf62478e57

SHA1
6123cb2171b903c66908c51f01730683cae0e913

SHA256
5d753acd2400b87b9a197264224e98df3261985126c6cbaa824825d6a3341fd5

SHA512
ed029e7b3fe346a1ff508cb46a87d4f735f1fd368c47bae420d769674c9105caa87d1fc9d300a7c5995f1adff0bda24a0a288e25ca2751a8832b547ad03da8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-414.exe
Filesize
468KB

MD5
0ee5b42e20c29d5d33633e2fb28a6c7d

SHA1
59ff4420812fd131a4de5a62ec20248e175d9bd2

SHA256
6c704ee690e6bb0bf44b33c15335146d541c69672fcb3e99a3225bacd95d0008

SHA512
94322cf191d696c120c5f5a30f4ea20e7ba816ce5248926b75293c9e16afe8d48d9eb8c3bfc21573727110bf81aa0f432684661d5c11eba2f7b693c358b5f43d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
Filesize
468KB

MD5
2deda6cbc287a26610c4613cb67d2c56

SHA1
e726ff53f570790a9e456b17b9d07fb48fda9527

SHA256
9c0a8f751c9f4a9d859bf789bd48f2d286e366a081b662fd0bb3c0963bcfbb85

SHA512
818b4ad8d44fc02ee698add9761a9134e0ba5451aecd0271d7f8bc680ea1f8b5a7b82a1ec9b46585b0ecbe4878891963e70a9f7aaead9608264f25487ca98059

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
Filesize
468KB

MD5
245fd29f29da7a5e04681d114aa85bb8

SHA1
7b9ca3867147aad679e1411854568a6f534dc61a

SHA256
b7b134d1e523aa5112a7db900ba45aca4d70e083e3560aba67a0e939585fcf7c

SHA512
28a18a95172833326d01bea3eaa48f1e911d75be2c96dca3dd030b8467ef78bfa11d6fc2bd5af622128053cd685f0502eea9c349f705fff02f161d8de1b66d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
Filesize
468KB

MD5
16f65deb3c807ca58e032684ac4c8504

SHA1
0bdbdeccf91713f80d8d44853441e5f5f7dcdbfe

SHA256
c54b43779aa77217246a15357e5e574ce10ff1450fdcaeed4d1ca893c26eff22

SHA512
aff83d1bb38f713c5784b2e7d076ff963b1f421af4903c13b6f306ff5075661008efa83820f08d89f0fa8a6bbd21cf67013ecac76c44eed9da0413254bea7e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51201.exe
Filesize
468KB

MD5
f9d5842a8af75f80d863c7ea3bbb45b8

SHA1
e9e299a3cb491bb7f64039c80409f1cff91cc300

SHA256
45532363ed42a14b5000dc9f97535e1b009771be14f3a5614e8d3175e98ec6c9

SHA512
f82e60b34776ee69ace2c51d20cae2146cbca8bafc8f1c2830c9d0185139f19589d5cdffc2e608535dc48eb11a0a94f4af10b7e62f122d275afb821033a3d7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51582.exe
Filesize
468KB

MD5
189d2d40ed4d7dbfb8d1389eb8193180

SHA1
b50be6b17a5c29b4c7ad0aa13015dc79fc44acc0

SHA256
9f0018edc53fbea77af3121c3bd03a6700339fe9c81dbc198b14ddc1df7d0fce

SHA512
d289efe03c6024d6f3e4d7e51d642ab43e5212af9ea26ae9222967d0892d75558e78c4d87037cadedd09365e8582801671f50a0db21115811a4e173b4aef0626

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
Filesize
468KB

MD5
3d54e1d997dcabfcdfd5b55058a52d28

SHA1
bf0cffaeac649d2bb0d06f3fd91c182b84a71d3f

SHA256
3322724f4d87b8f017088b1b5fe1b1a8d452d44a68840ddf30c8180312b144de

SHA512
05d67c54931cec0ec9c4a864def783f50b2c3caa522f97aed5356e2e9f17f3e6ded68da71d3d47e8d470b761608497c65ddf4c164f66bfda31ae85acff4672b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
Filesize
468KB

MD5
2b0da61fcab4eb3effb45300af350ba9

SHA1
9614a5bdec1ab2943ff7180d7fad37dbe3757504

SHA256
350e460b1eeae8a647ee7f14d5c51556acb841f94125522632fbb46b5833b9a3

SHA512
62dcdf12aab6b26e47d501037d795caadfccad1a3df98d336ce569d222f35fe5d0586476768d21a37eaea85c204dd56c87885810daca4dc7ef6f0ded3de39ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
Filesize
468KB

MD5
da1fb53203b152273fde00be05a84681

SHA1
8fc7f5b92b245b3d60d29b5967ef9ece7f55faf8

SHA256
d4968b1fbb0860e72520e27117ee5464a490e601c9ed7acd200870ea0572aee9

SHA512
bf040a3828ce58715d74ddfc6083d707afba651319d6946c8968ea1e1b1cabd2b8a6cde8e8ef8c496dea3a8e8d5cbef8494aa1c92b0b16fbd4b73fd07c4be0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
Filesize
468KB

MD5
07a6ecf5c554b1ebc91d6a783664af91

SHA1
4c08fe800b226c782fd1fddcf9172851dfeb36ce

SHA256
18f9cf0dda17c518cce879fa1ee550f6bed07422a2785a32d5b0be315a716a6b

SHA512
4e62ae1d740db8dcbdc7bf575038c23c61f55dfb3a9a957b81bb3dd83371eee25b568aeca520896ffcce57a59fd720255530550c0ce124268059ffb3e879193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
Filesize
468KB

MD5
4d9eb92a929bb03ee620761fa8863de2

SHA1
7a118b33d4598389b8643bb03b7b98a7ffa501df

SHA256
d5b821cbc7974290d048765cb302578efc6eaf27a79a7995f3753a9a0d3264ba

SHA512
a4215d0068e147b83eb9ced6aaef351ccbd354aa5b604da8a00a85cd6f7c64852b5e81ca282e62f41b4d38283e1b818ccaadfd4dd900872c87606f821b70dc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60216.exe
Filesize
468KB

MD5
78a2fdb8b185fa28d7181edbcd7a1d6b

SHA1
a723f57aff3415761a06c753a71ee4bffd387acb

SHA256
b07f63dbcfd4d97a9304102a1cb222f636ede791d3d4034715cd7f3882a535a7

SHA512
31cab1e89e7a8b3198528dc0c55eea5019af4358eb347913c435280d3fbfdeb8cdb5be8bf2a1655b82c75debeb325fa702c6d84be8d3d7d51067dd64bf424f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
Filesize
468KB

MD5
daa084dfde69cbfa1af4331ca074dcdd

SHA1
83c8a92e4238ff46d2e900549d585ec05f45e4f0

SHA256
16415d06377fa1c63f6f2b7acf89b4abe157c0d403ad4ca449c0c7851d52f9e6

SHA512
3349b3bab9313d7e7d5a11e542f206a795de3a1021ec778dc54152c7a51c106242dcfa0e8b72391c51a5761fc5f408c874051c9165056aff8d8f64d6be78e520

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9213.exe
Filesize
468KB

MD5
683056a71b8bbba5b18c31c77ff5bd1b

SHA1
90d9c6d66169a1ac9919a4e89c904fc06421a3ec

SHA256
651a4640b88ab2cbb4ce2057d31ed17244f33729ba0f2d1fae7b69f7f9b23f16

SHA512
4ab7d6b25c6ff5ca6e7e5fea61b1f3636802819a139092db5880ac23526a46994541cb9cb31a73732651817a1db0a09773be4d1a6a30933ad1976fb2b367c6e0

Download Submit
memory/316-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/416-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/508-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-25-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3488-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4636-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5804-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6040-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6072-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download