58dcc9bc98379e3b7c65109a66fcf0f5731b1110d1e46a0e03a228d6fb4fc0e2

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
Size

184KB
MD5

846cfe154fbfedd6b2f657a1f0179750
SHA1

f137c694a26f84f433e9f6d06d05b20d3338edd8
SHA256

58dcc9bc98379e3b7c65109a66fcf0f5731b1110d1e46a0e03a228d6fb4fc0e2
SHA512

4ef4f98727628a6d409d74754550a8fa6188d18f699045b095e95657c3af91c626a5c8b5068f9a5c1ae3d9b9016e8008a4b80d9088e6de5ae404bf3ef69ce082
SSDEEP

3072:JeA3XxofxhMjVH+We95LRfO3hlnnQFvn3:JeqoEBH+5L1O3hlnnQFv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2156	Unicorn-60280.exe
2380	Unicorn-55615.exe
2540	Unicorn-46933.exe
2556	Unicorn-40405.exe
2680	Unicorn-20539.exe
2604	Unicorn-32237.exe
840	Unicorn-15511.exe
2420	Unicorn-31163.exe
1528	Unicorn-20534.exe
316	Unicorn-45039.exe
988	Unicorn-64904.exe
2036	Unicorn-22414.exe
2004	Unicorn-59917.exe
2196	Unicorn-51941.exe
2016	Unicorn-6269.exe
668	Unicorn-65366.exe
1664	Unicorn-61837.exe
572	Unicorn-16166.exe
408	Unicorn-37484.exe
2124	Unicorn-17618.exe
1260	Unicorn-12787.exe
1876	Unicorn-26109.exe
112	Unicorn-24499.exe
1484	Unicorn-44365.exe
1912	Unicorn-24499.exe
2984	Unicorn-19669.exe
680	Unicorn-65340.exe
2120	Unicorn-52725.exe
1552	Unicorn-24691.exe
880	Unicorn-3524.exe
2524	Unicorn-26379.exe
2668	Unicorn-39185.exe
2820	Unicorn-18595.exe
2596	Unicorn-59627.exe
2428	Unicorn-3327.exe
2448	Unicorn-9274.exe
2508	Unicorn-64183.exe
2276	Unicorn-23150.exe
1240	Unicorn-43016.exe
2492	Unicorn-39486.exe
2068	Unicorn-59352.exe
2764	Unicorn-55823.exe
1492	Unicorn-10151.exe
1576	Unicorn-55138.exe
2328	Unicorn-55138.exe
1000	Unicorn-9466.exe
1040	Unicorn-38278.exe
1836	Unicorn-38278.exe
692	Unicorn-43300.exe
1584	Unicorn-38470.exe
2616	Unicorn-43492.exe
1252	Unicorn-42148.exe
3068	Unicorn-12813.exe
3004	Unicorn-17452.exe
632	Unicorn-58677.exe
3008	Unicorn-50509.exe
2324	Unicorn-37894.exe
2372	Unicorn-43862.exe
1384	Unicorn-60198.exe
2560	Unicorn-64837.exe
2684	Unicorn-4453.exe
2488	Unicorn-52222.exe
2544	Unicorn-44054.exe
2444	Unicorn-40524.exe

Loads dropped DLL 64 IoCs

pid	Process
2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
2156	Unicorn-60280.exe
2156	Unicorn-60280.exe
2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
2380	Unicorn-55615.exe
2380	Unicorn-55615.exe
2156	Unicorn-60280.exe
2156	Unicorn-60280.exe
2540	Unicorn-46933.exe
2540	Unicorn-46933.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2680	Unicorn-20539.exe
2680	Unicorn-20539.exe
2604	Unicorn-32237.exe
2604	Unicorn-32237.exe
2540	Unicorn-46933.exe
2540	Unicorn-46933.exe
2380	Unicorn-55615.exe
2556	Unicorn-40405.exe
2380	Unicorn-55615.exe
2556	Unicorn-40405.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1512	WerFault.exe
1572	WerFault.exe
1512	WerFault.exe
840	Unicorn-15511.exe
2680	Unicorn-20539.exe
840	Unicorn-15511.exe
2680	Unicorn-20539.exe
2604	Unicorn-32237.exe
2604	Unicorn-32237.exe
2420	Unicorn-31163.exe
2420	Unicorn-31163.exe
988	Unicorn-64904.exe
988	Unicorn-64904.exe
2556	Unicorn-40405.exe
316	Unicorn-45039.exe
2556	Unicorn-40405.exe
316	Unicorn-45039.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
1740	WerFault.exe
2400	WerFault.exe
2400	WerFault.exe
2400	WerFault.exe
2400	WerFault.exe
2400	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2584	2140	WerFault.exe	28
2484	2156	WerFault.exe	29
1572	2380	WerFault.exe	30
1512	2540	WerFault.exe	31
1740	2680	WerFault.exe	34
2400	2604	WerFault.exe	35
2288	2556	WerFault.exe	33
1440	840	WerFault.exe	37
1588	2420	WerFault.exe	38
2204	988	WerFault.exe	41
2360	1528	WerFault.exe	39
1736	316	WerFault.exe	40
2084	2036	WerFault.exe	44
2528	2196	WerFault.exe	46
2240	2004	WerFault.exe	45
1732	2016	WerFault.exe	47
2392	668	WerFault.exe	48
2232	572	WerFault.exe	50
804	1664	WerFault.exe	49
2072	408	WerFault.exe	54
1352	2124	WerFault.exe	55
328	2984	WerFault.exe	62
848	2120	WerFault.exe	63
1488	112	WerFault.exe	58
2516	680	WerFault.exe	61
1200	1260	WerFault.exe	56
1888	1484	WerFault.exe	60
3064	1876	WerFault.exe	57
2148	880	WerFault.exe	65
2580	1552	WerFault.exe	64
2460	1912	WerFault.exe	59
1868	2668	WerFault.exe	72
536	2524	WerFault.exe	71
2692	2820	WerFault.exe	73
1012	2596	WerFault.exe	74
1212	1576	WerFault.exe	84
3080	2428	WerFault.exe	75
844	2508	WerFault.exe	77
3112	1000	WerFault.exe	86
3136	1240	WerFault.exe	79
3144	2492	WerFault.exe	80
3184	1492	WerFault.exe	83
3200	2276	WerFault.exe	78
3224	2764	WerFault.exe	82
3232	2328	WerFault.exe	85
3308	2448	WerFault.exe	76
3456	2068	WerFault.exe	81
3496	692	WerFault.exe	96
3508	1836	WerFault.exe	94
3588	1584	WerFault.exe	97
4064	2324	WerFault.exe	104
3928	2304	WerFault.exe	112
3920	1520	WerFault.exe	118
3940	1232	WerFault.exe	113
3748	2372	WerFault.exe	105
3716	2684	WerFault.exe	108
4016	3004	WerFault.exe	101
3376	2704	WerFault.exe	115
3600	2868	WerFault.exe	131
4140	2632	WerFault.exe	139
4164	836	WerFault.exe	114
4188	2944	WerFault.exe	146
4196	3068	WerFault.exe	100
4244	1480	WerFault.exe	141

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
2156	Unicorn-60280.exe
2380	Unicorn-55615.exe
2540	Unicorn-46933.exe
2556	Unicorn-40405.exe
2680	Unicorn-20539.exe
2604	Unicorn-32237.exe
840	Unicorn-15511.exe
2420	Unicorn-31163.exe
1528	Unicorn-20534.exe
316	Unicorn-45039.exe
988	Unicorn-64904.exe
2036	Unicorn-22414.exe
2004	Unicorn-59917.exe
2196	Unicorn-51941.exe
2016	Unicorn-6269.exe
668	Unicorn-65366.exe
572	Unicorn-16166.exe
1664	Unicorn-61837.exe
408	Unicorn-37484.exe
2124	Unicorn-17618.exe
1260	Unicorn-12787.exe
1876	Unicorn-26109.exe
1912	Unicorn-24499.exe
112	Unicorn-24499.exe
2984	Unicorn-19669.exe
1484	Unicorn-44365.exe
680	Unicorn-65340.exe
1552	Unicorn-24691.exe
2120	Unicorn-52725.exe
880	Unicorn-3524.exe
2524	Unicorn-26379.exe
2668	Unicorn-39185.exe
2820	Unicorn-18595.exe
2596	Unicorn-59627.exe
2428	Unicorn-3327.exe
2448	Unicorn-9274.exe
2508	Unicorn-64183.exe
2276	Unicorn-23150.exe
2492	Unicorn-39486.exe
1240	Unicorn-43016.exe
2764	Unicorn-55823.exe
2068	Unicorn-59352.exe
1576	Unicorn-55138.exe
1492	Unicorn-10151.exe
2328	Unicorn-55138.exe
1000	Unicorn-9466.exe
1836	Unicorn-38278.exe
692	Unicorn-43300.exe
1584	Unicorn-38470.exe
2616	Unicorn-43492.exe
1252	Unicorn-42148.exe
3068	Unicorn-12813.exe
3004	Unicorn-17452.exe
632	Unicorn-58677.exe
3008	Unicorn-50509.exe
2324	Unicorn-37894.exe
1384	Unicorn-60198.exe
2560	Unicorn-64837.exe
2684	Unicorn-4453.exe
2488	Unicorn-52222.exe
2544	Unicorn-44054.exe
2304	Unicorn-32679.exe
2444	Unicorn-40524.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2156	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 2156	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 2156	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 2156	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	29
PID 2156 wrote to memory of 2380	2156	Unicorn-60280.exe	30
PID 2156 wrote to memory of 2380	2156	Unicorn-60280.exe	30
PID 2156 wrote to memory of 2380	2156	Unicorn-60280.exe	30
PID 2156 wrote to memory of 2380	2156	Unicorn-60280.exe	30
PID 2140 wrote to memory of 2540	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2540	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2540	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2540	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2584	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2584	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2584	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2584	2140	846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe	32
PID 2380 wrote to memory of 2556	2380	Unicorn-55615.exe	33
PID 2380 wrote to memory of 2556	2380	Unicorn-55615.exe	33
PID 2380 wrote to memory of 2556	2380	Unicorn-55615.exe	33
PID 2380 wrote to memory of 2556	2380	Unicorn-55615.exe	33
PID 2156 wrote to memory of 2680	2156	Unicorn-60280.exe	34
PID 2156 wrote to memory of 2680	2156	Unicorn-60280.exe	34
PID 2156 wrote to memory of 2680	2156	Unicorn-60280.exe	34
PID 2156 wrote to memory of 2680	2156	Unicorn-60280.exe	34
PID 2540 wrote to memory of 2604	2540	Unicorn-46933.exe	35
PID 2540 wrote to memory of 2604	2540	Unicorn-46933.exe	35
PID 2540 wrote to memory of 2604	2540	Unicorn-46933.exe	35
PID 2540 wrote to memory of 2604	2540	Unicorn-46933.exe	35
PID 2156 wrote to memory of 2484	2156	Unicorn-60280.exe	36
PID 2156 wrote to memory of 2484	2156	Unicorn-60280.exe	36
PID 2156 wrote to memory of 2484	2156	Unicorn-60280.exe	36
PID 2156 wrote to memory of 2484	2156	Unicorn-60280.exe	36
PID 2680 wrote to memory of 840	2680	Unicorn-20539.exe	37
PID 2680 wrote to memory of 840	2680	Unicorn-20539.exe	37
PID 2680 wrote to memory of 840	2680	Unicorn-20539.exe	37
PID 2680 wrote to memory of 840	2680	Unicorn-20539.exe	37
PID 2604 wrote to memory of 2420	2604	Unicorn-32237.exe	38
PID 2604 wrote to memory of 2420	2604	Unicorn-32237.exe	38
PID 2604 wrote to memory of 2420	2604	Unicorn-32237.exe	38
PID 2604 wrote to memory of 2420	2604	Unicorn-32237.exe	38
PID 2540 wrote to memory of 1528	2540	Unicorn-46933.exe	39
PID 2540 wrote to memory of 1528	2540	Unicorn-46933.exe	39
PID 2540 wrote to memory of 1528	2540	Unicorn-46933.exe	39
PID 2540 wrote to memory of 1528	2540	Unicorn-46933.exe	39
PID 2380 wrote to memory of 316	2380	Unicorn-55615.exe	40
PID 2380 wrote to memory of 316	2380	Unicorn-55615.exe	40
PID 2380 wrote to memory of 316	2380	Unicorn-55615.exe	40
PID 2380 wrote to memory of 316	2380	Unicorn-55615.exe	40
PID 2556 wrote to memory of 988	2556	Unicorn-40405.exe	41
PID 2556 wrote to memory of 988	2556	Unicorn-40405.exe	41
PID 2556 wrote to memory of 988	2556	Unicorn-40405.exe	41
PID 2556 wrote to memory of 988	2556	Unicorn-40405.exe	41
PID 2380 wrote to memory of 1572	2380	Unicorn-55615.exe	42
PID 2380 wrote to memory of 1572	2380	Unicorn-55615.exe	42
PID 2380 wrote to memory of 1572	2380	Unicorn-55615.exe	42
PID 2380 wrote to memory of 1572	2380	Unicorn-55615.exe	42
PID 2540 wrote to memory of 1512	2540	Unicorn-46933.exe	43
PID 2540 wrote to memory of 1512	2540	Unicorn-46933.exe	43
PID 2540 wrote to memory of 1512	2540	Unicorn-46933.exe	43
PID 2540 wrote to memory of 1512	2540	Unicorn-46933.exe	43
PID 840 wrote to memory of 2036	840	Unicorn-15511.exe	44
PID 840 wrote to memory of 2036	840	Unicorn-15511.exe	44
PID 840 wrote to memory of 2036	840	Unicorn-15511.exe	44
PID 840 wrote to memory of 2036	840	Unicorn-15511.exe	44

C:\Users\Admin\AppData\Local\Temp\846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\846cfe154fbfedd6b2f657a1f0179750_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19669.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59627.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16317.exe
        10⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        11⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        12⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14348.exe
        13⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        14⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64600.exe
        15⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9996 -s 216
        15⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 216
        14⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 216
        13⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 236
        12⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 236
        11⤵
        Program crash
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
        10⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        11⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64867.exe
        12⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        13⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28529.exe
        14⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10292 -s 216
        14⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7460 -s 216
        13⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 216
        12⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 236
        11⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 240
        10⤵
        Program crash
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        9⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        10⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        11⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        12⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40174.exe
        13⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
        14⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        15⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10496 -s 236
        15⤵
        
        PID:13372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 216
        14⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 216
        13⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 216
        12⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 236
        11⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        10⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46626.exe
        11⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61466.exe
        12⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53613.exe
        13⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        14⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8248 -s 236
        13⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 216
        12⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 216
        11⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 240
        10⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 240
        9⤵
        Program crash
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50509.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28076.exe
        9⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55105.exe
        10⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42895.exe
        11⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        12⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        13⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        14⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11056 -s 216
        14⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7700 -s 216
        13⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 216
        12⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 216
        11⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 236
        10⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43599.exe
        9⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        10⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        11⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
        12⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11248 -s 200
        13⤵
        
        PID:928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 236
        12⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 216
        11⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 216
        10⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 240
        9⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 240
        8⤵
        Program crash
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        8⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        9⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
        10⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29969.exe
        11⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        12⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6118.exe
        13⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10652 -s 216
        13⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8128 -s 216
        12⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 216
        11⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 216
        10⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 236
        9⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 236
        8⤵
        Program crash
        
        PID:844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 240
        7⤵
        Program crash
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        9⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        10⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        11⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        12⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53904.exe
        13⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8876 -s 216
        13⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 216
        12⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 216
        11⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 236
        10⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 236
        9⤵
        Program crash
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32496.exe
        8⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61083.exe
        9⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10653.exe
        10⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31415.exe
        11⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        12⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6596 -s 216
        11⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 236
        10⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 216
        9⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 240
        8⤵
        Program crash
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        9⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        10⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        11⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52951.exe
        12⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        13⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11020 -s 216
        13⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7644 -s 216
        12⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 220
        11⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 216
        10⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 236
        9⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3252.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14290.exe
        9⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        10⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22448.exe
        11⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        12⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 216
        12⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 216
        11⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 236
        10⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 236
        9⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240
        8⤵
        Program crash
        
        PID:3376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 240
        7⤵
        Program crash
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 220
        6⤵
        Program crash
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61837.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17452.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        8⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        9⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63107.exe
        10⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        11⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53667.exe
        12⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        13⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10156 -s 216
        13⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 216
        12⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 216
        11⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 216
        10⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 236
        9⤵
        Program crash
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39755.exe
        9⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10071.exe
        9⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        10⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        11⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        12⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10932 -s 236
        12⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 216
        11⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 220
        10⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 220
        9⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 240
        8⤵
        Program crash
        
        PID:4016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 236
        7⤵
        Program crash
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57567.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43810.exe
        8⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6838.exe
        9⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        10⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        11⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52484.exe
        12⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        13⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10852 -s 220
        13⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 216
        12⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 216
        11⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 216
        10⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 236
        9⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 236
        8⤵
        Program crash
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39595.exe
        7⤵
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        8⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        9⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17582.exe
        10⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        11⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        12⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11092 -s 216
        12⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 216
        11⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 216
        10⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 216
        9⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 216
        8⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 240
        7⤵
        Program crash
        
        PID:3232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 240
        6⤵
        Program crash
        
        PID:804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45039.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16166.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3327.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43862.exe
        8⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        9⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        10⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        11⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16553.exe
        12⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
        13⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10160 -s 216
        13⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6852 -s 236
        12⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 216
        11⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 236
        9⤵
        Program crash
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
        8⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        9⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        10⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        11⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        12⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
        13⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 216
        12⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 220
        11⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 216
        10⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 236
        9⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 220
        8⤵
        Program crash
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31094.exe
        9⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        10⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        11⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38291.exe
        12⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        13⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9496 -s 216
        13⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 216
        12⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 236
        11⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 216
        10⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 216
        9⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45256.exe
        9⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        10⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        11⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24292.exe
        12⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10396 -s 216
        12⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 216
        11⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 216
        10⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 236
        9⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 220
        8⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 220
        7⤵
        Program crash
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
        7⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        8⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        9⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31198.exe
        10⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8069.exe
        11⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19812.exe
        12⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        13⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10900 -s 216
        13⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 216
        12⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 216
        11⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 216
        10⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 236
        9⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10735.exe
        8⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 240
        8⤵
        Program crash
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        7⤵
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        9⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        10⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-522.exe
        11⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57156.exe
        12⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10800 -s 220
        12⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 216
        11⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 216
        10⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 236
        9⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 236
        8⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240
        7⤵
        Program crash
        
        PID:3200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 240
        6⤵
        Program crash
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
        8⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        9⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9937.exe
        10⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37331.exe
        11⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17595.exe
        12⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9768 -s 216
        12⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 216
        11⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 236
        10⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 236
        9⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 216
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54358.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38329.exe
        9⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        10⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        11⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 216
        11⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8176 -s 216
        10⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 216
        9⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 216
        8⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 240
        7⤵
        
        PID:4980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 236
        6⤵
        Program crash
        
        PID:2580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 240
        5⤵
        Program crash
        
        PID:1736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
        9⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40707.exe
        10⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        11⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        12⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        13⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe
        14⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10196 -s 216
        14⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 216
        13⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 236
        12⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 236
        11⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        10⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37140.exe
        11⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46313.exe
        12⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23673.exe
        13⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        14⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7404 -s 220
        13⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 216
        12⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 216
        11⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 240
        10⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36025.exe
        9⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        10⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
        11⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23454.exe
        12⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        13⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        14⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10260 -s 216
        14⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 216
        13⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 216
        12⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 216
        11⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 216
        10⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 240
        9⤵
        Program crash
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        8⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
        9⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40279.exe
        10⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        11⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44891.exe
        12⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48211.exe
        13⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
        14⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 216
        13⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 216
        12⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 216
        11⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 236
        10⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        9⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18365.exe
        10⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21778.exe
        11⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37277.exe
        12⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        13⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8212 -s 216
        12⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 216
        11⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 216
        10⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 240
        9⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 240
        8⤵
        Program crash
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        8⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
        9⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7222.exe
        10⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17213.exe
        11⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        12⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        13⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
        14⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7980 -s 216
        13⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 220
        12⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 216
        11⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236
        10⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20413.exe
        9⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45308.exe
        10⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        11⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        12⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        13⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7572 -s 216
        12⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 216
        11⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 240
        9⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4505.exe
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45749.exe
        10⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        11⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45606.exe
        12⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8704 -s 236
        12⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 236
        11⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 216
        10⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 236
        9⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 240
        8⤵
        Program crash
        
        PID:3496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 240
        7⤵
        Program crash
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38278.exe
        7⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        7⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        8⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        9⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29356.exe
        10⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        11⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6376.exe
        12⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        13⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 216
        12⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 216
        11⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 216
        10⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 216
        9⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        8⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        9⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57169.exe
        10⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18904.exe
        11⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        12⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 216
        11⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 216
        10⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 216
        9⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 240
        8⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240
        7⤵
        Program crash
        
        PID:1868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 240
        6⤵
        Program crash
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4339.exe
        8⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        9⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39127.exe
        10⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59713.exe
        10⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50508.exe
        11⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40097.exe
        12⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23184.exe
        13⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10228 -s 216
        13⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 236
        12⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 216
        11⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 220
        10⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43958.exe
        9⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        10⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57768.exe
        11⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        12⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        13⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10456 -s 220
        13⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 216
        12⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 216
        11⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 216
        10⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 240
        9⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11521.exe
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        9⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
        10⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48534.exe
        11⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47793.exe
        12⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        13⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10332 -s 216
        13⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7272 -s 216
        12⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 216
        11⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 216
        10⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 236
        9⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 240
        8⤵
        Program crash
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52824.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        9⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40690.exe
        10⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45115.exe
        11⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        12⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 216
        12⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 216
        11⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 216
        10⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 236
        9⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 236
        8⤵
        Program crash
        
        PID:3600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 240
        7⤵
        Program crash
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        7⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8008.exe
        8⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63875.exe
        9⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32029.exe
        10⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        11⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        12⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10220 -s 216
        12⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 216
        11⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 216
        10⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 236
        9⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 236
        8⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        9⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
        10⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        11⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8144 -s 216
        10⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 216
        9⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 216
        8⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 240
        7⤵
        
        PID:4868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 240
        6⤵
        Program crash
        
        PID:1352
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 240
        5⤵
        Program crash
        
        PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10151.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24511.exe
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59269.exe
        8⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        9⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        10⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22709.exe
        11⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44456.exe
        12⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13593.exe
        13⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10212 -s 216
        13⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 216
        12⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 236
        11⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 216
        10⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 216
        9⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21892.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        9⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55355.exe
        10⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        11⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60490.exe
        12⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10272 -s 216
        12⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7516 -s 216
        11⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 216
        10⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 216
        9⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 240
        8⤵
        Program crash
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55790.exe
        8⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22070.exe
        9⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        10⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        11⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        12⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10548 -s 216
        12⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8112 -s 216
        11⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 216
        10⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 216
        9⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 216
        8⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 240
        7⤵
        Program crash
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20981.exe
        6⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1900.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37913.exe
        9⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        10⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        11⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28093.exe
        12⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10464 -s 216
        12⤵
        
        PID:820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7760 -s 216
        11⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 216
        10⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 216
        9⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 216
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23311.exe
        9⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47326.exe
        10⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        11⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11196 -s 216
        11⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 216
        10⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 216
        9⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 216
        8⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 220
        7⤵
        
        PID:4956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 240
        6⤵
        Program crash
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
        8⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        9⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        10⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31073.exe
        11⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
        12⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10576 -s 216
        12⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7408 -s 220
        11⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 216
        10⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 216
        9⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 236
        8⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 236
        7⤵
        Program crash
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47956.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19192.exe
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23035.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        9⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe
        10⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63510.exe
        11⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10000 -s 216
        11⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 216
        10⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 216
        9⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 236
        8⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236
        7⤵
        Program crash
        
        PID:4188
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 240
        6⤵
        Program crash
        
        PID:1212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 240
        5⤵
        Program crash
        
        PID:2240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46933.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6269.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        9⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        10⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        11⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50067.exe
        12⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25546.exe
        13⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        14⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10424 -s 216
        14⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 216
        13⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 216
        12⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 236
        11⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 216
        10⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36735.exe
        10⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        11⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53719.exe
        12⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        13⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10976 -s 216
        13⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 216
        12⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 216
        11⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 240
        9⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        8⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        9⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
        10⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
        11⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18847.exe
        12⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        13⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11132 -s 216
        13⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 216
        12⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 216
        11⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 216
        10⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 236
        9⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 240
        8⤵
        Program crash
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59461.exe
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
        9⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        10⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        11⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        12⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        13⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 216
        11⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 216
        10⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 236
        9⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5172.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        9⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        10⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        11⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21954.exe
        12⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10388 -s 216
        12⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 216
        11⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 216
        10⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 216
        9⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 220
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 240
        7⤵
        Program crash
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52414.exe
        7⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26213.exe
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        9⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        10⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        11⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        12⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31352.exe
        13⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 216
        13⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6224 -s 216
        12⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 236
        11⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 216
        10⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 236
        9⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46273.exe
        9⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        10⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        11⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        12⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9308 -s 236
        12⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 236
        11⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 236
        10⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 216
        9⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 220
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        7⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63657.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        9⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1471.exe
        10⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48979.exe
        11⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        12⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7248 -s 216
        11⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 216
        10⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 216
        9⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 236
        8⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 240
        7⤵
        Program crash
        
        PID:3224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 240
        6⤵
        Program crash
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42148.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        7⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61265.exe
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        10⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        11⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56196.exe
        12⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10312 -s 216
        12⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 216
        11⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 216
        10⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 236
        9⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 236
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64863.exe
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31374.exe
        10⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
        11⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11228 -s 216
        11⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7984 -s 216
        10⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 220
        9⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 216
        8⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 240
        7⤵
        
        PID:4328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 216
        6⤵
        Program crash
        
        PID:1488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 240
        5⤵
        Program crash
        
        PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        8⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        9⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27633.exe
        10⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        11⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
        12⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
        13⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10768 -s 220
        13⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 216
        12⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 216
        11⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 236
        10⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 236
        9⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35815.exe
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29854.exe
        9⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        10⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39381.exe
        11⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        12⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10720 -s 220
        12⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7220 -s 216
        11⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 216
        10⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 216
        9⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 220
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32304.exe
        7⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63273.exe
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48878.exe
        9⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        10⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        11⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31350.exe
        12⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7192 -s 216
        11⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 216
        10⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 216
        9⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 216
        8⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 220
        7⤵
        Program crash
        
        PID:3136
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 236
        6⤵
        Program crash
        
        PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
        6⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        9⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        10⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10516 -s 188
        11⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 220
        10⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 216
        9⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 216
        8⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 216
        7⤵
        
        PID:4920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 236
        6⤵
        Program crash
        
        PID:3144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 240
        5⤵
        Program crash
        
        PID:2528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9684.exe
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54046.exe
        8⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        9⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        10⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        11⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8940 -s 216
        11⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 236
        10⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 216
        9⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 216
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        9⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30891.exe
        10⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36077.exe
        11⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10284 -s 216
        11⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 216
        10⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 216
        9⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 216
        8⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 220
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        6⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22433.exe
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38982.exe
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58152.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23538.exe
        10⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        11⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10480 -s 216
        11⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 216
        10⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 216
        9⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 216
        8⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 236
        7⤵
        
        PID:4932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 240
        6⤵
        Program crash
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22678.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        9⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
        10⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9736 -s 216
        10⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 216
        9⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 236
        8⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 216
        7⤵
        
        PID:5940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 236
        6⤵
        Program crash
        
        PID:3716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 220
        5⤵
        Program crash
        
        PID:2460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 236
      4⤵
      Program crash
      PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 240
  2⤵
  - Program crash
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe

Filesize
184KB

MD5
c1e70ea1e3263af1caab67adf9d3b009

SHA1
329c30b7e9849fcd1cac3a62655851a4d6327529

SHA256
66827ced004196adaf5a857d59284e7d810c5a049a53ca6cdb8d3c3a3743cb5d

SHA512
4591c25fbc50377eb55b210ff36aea56b1d8927be80a8f77843a9d5e4ae7498a48d3bbfc365836e90ad203131169ff56e0b97b7720c6270b97781b162923501d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe

Filesize
184KB

MD5
d497c8c4b19efcf20b946cb3d13602b8

SHA1
60e51cd4e5007457e885bb0d1122228186dab6a5

SHA256
fd527b25aad257b69b39c1233ffe457f2cf9cc3ca077803a9fddd110f30bbaa0

SHA512
ac585dd765867d3957b6bd16037b10e50f911e46efb33b44d505f21600d11d1fb762d645082c6381bec23e6ce0aa8eb44bb26bc172ec66d20fe752add1a49441

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20539.exe

Filesize
184KB

MD5
6a63538f3ab0a99682dcaf9cf211f696

SHA1
f53c5f9b7fc00989193ca4ffcb4ce6e040cb9a55

SHA256
45248b411904e1ad12be284a14fc779d51a1f7a14e664dd43594188c0941fb51

SHA512
cb0736134432b5ee5876fab054dd4fdd3af7fe3d1a1cef8d00180493dc1170d556258e8f2c7a2b3fd551331fc3cbb4efdfc921e4badd45568535a7e8c7418606

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe

Filesize
184KB

MD5
43bf70a89bf2381d6a878c925c83361f

SHA1
1da643eb59b5c5995a3d35d87f974fe8d79ff2a3

SHA256
2641d991edb68d33dae788745c63a3f08435d266a8e229fbef174ee9b9eefcb2

SHA512
d781a2ea7912e94a2c3aae573aba95538a9794cfffcf98497fd69c8a0347a6bf6732fdb0f200ce4994cfdb1e1027e73da1211863d0494c24fff53b683e7d41f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe

Filesize
184KB

MD5
9a5108f6a57a5a6202d50eaf13c743f6

SHA1
e319033327f5fd9da564a7631d3be7070faa98a5

SHA256
d11d1edbb6fe318922f238832fbced612b1632fbabb13b21edd2cd460d75afb9

SHA512
1918ed677bc84b132c915e79a33cc3bdf83f0034588f328e73f5be7f4d765f0c162c061c614fca2da722a88f5c5de69ab7bd7438f2fb65f3e1fb3e2b5eab9273

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21710.exe

Filesize
184KB

MD5
4c3e14183aeeb32846fb429c9a6b6172

SHA1
6fd50b5207d8b1d6455e6af5ae057fa3965c81fa

SHA256
7f131831adfd18e2c784d9c1612c98c3a3ab0bd5c0fdca72156c86fed2d7334c

SHA512
c362a179e67698aea99bf703323ad92a7736768637bdd3f69a48b8605816ce7d4289ff201727a4a54d0386e923f9e3b0d2bcce86af81e386562a7987fd457012

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe

Filesize
184KB

MD5
9eb673a9b1c18d4f8dfeaef6fc171539

SHA1
8b7337251d3a21516748e646dac2ba086124075f

SHA256
a69336ea88e8df186a027fa09f1df1b4af7c2625bffce8cfb61a77df18e70f84

SHA512
68910ce5b70f47d824bee577c080e88918ca2886ac719eb7f476c1c239c43bae04773a76e9ec196141108d4c82f2b568beeed0aa5e6bb722b40bd331f4f8ec6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe

Filesize
184KB

MD5
4199b87a40dab58eaee673987d9a801f

SHA1
72a6debeb80bfbee333b56949e8a8607b1fca652

SHA256
39b29921b19d0090f8a7b24465c6bf627f1347437796a2194a2aa61ff6828d3e

SHA512
bd8cc73538b12f7e375c869a892122658b47b4a3f97e2f3049214d38ab096680e904446e5da8069c86a04b0091da3a3feaf41c7e78ace5439f8536f09cd1a794

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe

Filesize
184KB

MD5
8a0d0414b1e5ef189b261378d0357133

SHA1
6a26e5bdce48dd716ab14fccbb0cb05fde21350c

SHA256
e4bd15fcf61e5e2fdb411e04cef69b70dc671d48c57d2afc2fd1692e8e9ab909

SHA512
2856e59da249ddc0fd5454c1c7c2ff821cd406c407737a080e525b5a7782e7ad19746728a95b1ea9522906d2c5dc10e52094a4f66b47f03f1e6f7c2ee2113292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe

Filesize
184KB

MD5
1163dc7a6c5338c959499de1ed8ae2ad

SHA1
f37651c4595771302c721af7897910dbb6b7d1d3

SHA256
be691d8f05f26e20df6ec8dbe24e019588ee0eef666373c5144d3c76c0f7d4ce

SHA512
1dac97033f17b94f10fc3a5ce3387bc3774daa6ca6c009b0d5776bc58e407fefca6bbf2942df438fe84e253b416b77d01dd9a1ec5e99a270086260f59f18cfd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59917.exe

Filesize
184KB

MD5
cdc593ce190a09d6107ec7e30dadba71

SHA1
67997cfbb713e97955c7086bc6bec3f1f0d6ecd6

SHA256
b0256fa556fdadc535dfa2ce7d5b2d797a91c4cb13c067afdbf30873b590d157

SHA512
0c9bdafaec7e305b47608b1a147f181e48bac83e463d4dc741bde3a8659d0c9c31ec3ec938e058f2eb3ee9f08fec2f0b1fc2739c94aabc38932f69f3f0401949

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6269.exe

Filesize
184KB

MD5
9156d402c7b34a9bd4e531ddcae91a91

SHA1
267cd3d4ab0c7b0840c3e74f95d7c2ae6165207f

SHA256
65f9ad07ff4134b48064572dbe3875fa8dd6e43fcc8f38a2cfe5dd43b1f57b52

SHA512
aeb1ac7653350827bc4597b66d9cf78c9e540dadc70f697c4e4a4bf6a378d114ca62e79aba6eb9202a61f59a4886f2cc84c1df0d5f5e73db274d13ab0c8f823b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6838.exe

Filesize
184KB

MD5
2ac0b247403b26363bbe6b1583e1eab9

SHA1
2b9387e15507ebdb3c570be8511ddac6fb46a402

SHA256
7d4afd9a4a845ac92eea8f362d04e027734be9571f7f2cb22c61f81de0892a4a

SHA512
df290a3bc39ddaff1b654d68a4a9d1aabf28a4cf41c4a8a576bee1bcac89bf8584ab4820b8649421978e2de5fa733db421562566f4c749df68143410b11e021f

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe

Filesize
184KB

MD5
107d4c70713ef5e76b2207825a5a214e

SHA1
9f878cc3a2dc8fb87770e8fd27178a3411f22fb2

SHA256
cd243b134e71289dba2e63548469c6d7dbbc5342bcb776eb5acc9c46713f4653

SHA512
934860ae71bf3939354c60604606ceaa377ba1aefa7c9ed0287c059773324c70c0c64919243f30fbeeee7a4565ab5371fb48d490650370718dbbd627d624b088

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe

Filesize
184KB

MD5
fb6ac360a152c068b5ec32207c776820

SHA1
40335dcb8947bad09e032b13890bbcebeef5423f

SHA256
ea0ab67581936ec0d26daca034f9124919e5736007466c3cf51313f36125c92c

SHA512
a0ac1ab9a0ba4cebe8c6726dbd44f60457c7b2450c87c81b5fa1fd6cb2f424673c07bb32445fb99c4c03c430bb8d1e35d00fe1aa278f52d2ce2504c9bf4232d7

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-31163.exe

Filesize
184KB

MD5
fd86b7d3f0de0750c64e44075deb0300

SHA1
5737f0ed2a0063678eaeef02635c33bda2551586

SHA256
1b9cfa780ac84d9e58688ce72deba09867910807e12712b0bb9fc8aacaf269b8

SHA512
d85d2242a62b5988f0a9dd5c4a0f71f35f8603d7a05d7d8a0f1bf621cd10a87c1052cb4386fa7816182e3cc358142059204b25b28484a5fb2e51628049b9d587

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe

Filesize
184KB

MD5
bec5744b1e2f9ba193e5bf5a3d91b907

SHA1
86df753026151be3b4972ba731cd94369cf8295c

SHA256
db3e66940b334f1c069ca97c877b1e3dc1530868ac8e1eaf6bcec550721ff57f

SHA512
0b9cfd0a962557f7b4ac4a652bc0a0a1d44ee352730440c7aa91fa636c1f21f92e037ddb50d4ed2be821ecdf3cdc847726ccf7ef94f462fb3c957c967eec186e

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe

Filesize
184KB

MD5
22c80f523e7b3c943e0f81871c6a1e90

SHA1
1e14349a464de28813a41f096f228564f6e32c51

SHA256
fa9c28c05cdfb7fb1d0e2f059293a0d254321ea321ec356484ee80b72f517caf

SHA512
b30c9c8e46555eb42c45e94edad83d653d82509d0916ab1b21a95dd0e2bff5f0769f6ac9a163a1c1cbd85159966f4c005781db9ab5281aa450e663f6cd034c81

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-45039.exe

Filesize
184KB

MD5
ee34041bf81297c56274a604be4c4925

SHA1
147191ac760375115e622044be28817dea42ecfe

SHA256
d76a89180708f12f1938fa8a197e99a69bb2e8d58a95cd7747beff9682d62c5f

SHA512
1c23a52c341d341a62c00fee7cf4a6a6d16f83376d86548cad1a34a4515755a7ab62f85369b1fec8e36a0a57214827fdc1a687528b18e7e2e13545a36a0b6b6d

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-46933.exe

Filesize
184KB

MD5
5ce88c3f4dba2cb271375503118e4d73

SHA1
970b438f8979c380dfa548ee4085bdfc2100ee2b

SHA256
8dfe029b78d5d06b2e64cd14f58b1554bc66013b7014cbb9f22e42666466ad92

SHA512
9d9a87578de6e2fa713fe121f6b8f1e1b4e54d46caabed3017a87e4771e0eb33db104d985b861d19cbb6ae8fde1112081465ae43deea92d1ffb89b7cad98c7c4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-51941.exe

Filesize
184KB

MD5
4f65338f6c5cfde1d165290caee48971

SHA1
237bb90ff6a84a4f384949f74c752fb66464c0ff

SHA256
60aef92bacb33d6060211045eef8b0fdd961c1cd5c3522b2b3c236ca1b7bd206

SHA512
aaa5c2797c5173be47233c413f2da40fc59d736fabedc8b556a885cd9e592187e72fea5ec5d27cc8df57c0bea85f48ceeaeaa5aed2ff7fdc25b017865bccf2d4

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe

Filesize
184KB

MD5
81b2eb1aa04c75424cb02efd2c07c8da

SHA1
b1c39d7d909d1d61dc5466f97144d1fc2adb9e7b

SHA256
10eb49d5b4dd7ee2d619aac966ee23669d271c99d7a77499397196f9940a587d

SHA512
03ee26e71a625a7ec22559e5bb0af54427d31e29227d9ccf3dad5137707b02ded6c32a00d98f6559355ab90ad1f5e04f92a1b87c128956f634fc9447b2624a60

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe

Filesize
184KB

MD5
83902b30f640a4a77ef055800b485d97

SHA1
f6c12369b18f1e13cfa94e6fadc19f563a1b7b46

SHA256
c1a276bce2cd4adab39ed8568f2d2afd45491b3c04086e8b72d9a9c31a71b406

SHA512
fb02e4574bc0d4b9c80dc04bfe0a0c4155869d4350c8b2a101561e73626f706a64bebb635edfd9f1d1d8b7e691febe3600d0d6fee69bbd6f5f9dbb5a411cef51

Download Submit
\Users\Admin\AppData\Local\Temp\Unicorn-64904.exe

Filesize
184KB

MD5
5d5c006cafcd58913c0dc88a0a565378

SHA1
451ec937454e185032d35dd63cbfe4d9202aee84

SHA256
37800c9be5c28c7b9eed39a8a4fd6168b5305cea93227ff75fb2e2ebaebd48bd

SHA512
df19a22456633a87c02a2f42edb02a01edc1bfcf3666487672b03434a825986a5de66856213c02982b021745b4ac2f9e0a65b9bbef3400e549a688bc29d9d933

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads