1e4a7f87705ee872eb85ccc01f4cb55d03ea5db4a53559ecef2c7a6d3584135a

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
Size 184KB
Sample240527-pcnb9abb91
SHA256 1e4a7f87705ee872eb85ccc01f4cb55d03ea5db4a53559ecef2c7a6d3584135a
MD5 e7476d5e8d87bbff60e58f0dfc3dcfd0
SHA1 05f409631b431c7bc79a65b1ce5edb411171e2dd
SHA512 b7d139dbaa87372b5ba4b8661a2bbcabc18c298a9d1769b323cc072c66e7754326f5c5d9274df72260224f4575bd54302b107504c679b9f3763fde6ab49cf38f
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntOhl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gtOhlnVirK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2188	Unicorn-34958.exe
2568	Unicorn-54439.exe
2972	Unicorn-34573.exe
2748	Unicorn-58881.exe
2668	Unicorn-43099.exe
2064	Unicorn-45534.exe
2708	Unicorn-49618.exe
2556	Unicorn-29752.exe
2432	Unicorn-8030.exe
2712	Unicorn-57786.exe
2012	Unicorn-16753.exe
2740	Unicorn-32535.exe
3052	Unicorn-36462.exe
1276	Unicorn-25877.exe
268	Unicorn-6011.exe
1484	Unicorn-54657.exe
572	Unicorn-50573.exe
824	Unicorn-51128.exe
1556	Unicorn-33298.exe
1368	Unicorn-37382.exe
1040	Unicorn-21600.exe
1844	Unicorn-41466.exe
2868	Unicorn-12877.exe
2988	Unicorn-58549.exe
2996	Unicorn-62633.exe
612	Unicorn-33106.exe
1936	Unicorn-988.exe
3020	Unicorn-24938.exe
2976	Unicorn-40755.exe
2776	Unicorn-41309.exe
2480	Unicorn-32587.exe
2696	Unicorn-32587.exe
2624	Unicorn-12721.exe
2752	Unicorn-20335.exe
2532	Unicorn-3806.exe
2920	Unicorn-20143.exe
2912	Unicorn-44455.exe
2120	Unicorn-24589.exe
1108	Unicorn-28673.exe
2268	Unicorn-48539.exe
2408	Unicorn-16421.exe
1944	Unicorn-40371.exe
1256	Unicorn-35960.exe
2236	Unicorn-35960.exe
2704	Unicorn-3842.exe
1056	Unicorn-35768.exe
1900	Unicorn-27600.exe
1928	Unicorn-27600.exe
636	Unicorn-45560.exe
1536	Unicorn-32238.exe
1304	Unicorn-32238.exe
1784	Unicorn-41475.exe
1884	Unicorn-7864.exe
2940	Unicorn-40214.exe
1300	Unicorn-31492.exe
2856	Unicorn-32046.exe
2228	Unicorn-15841.exe
2404	Unicorn-32177.exe
1612	Unicorn-16395.exe
1608	Unicorn-36261.exe
2272	Unicorn-24009.exe
2684	Unicorn-28839.exe
2620	Unicorn-48705.exe
2800	Unicorn-24755.exe

Loads dropped DLL 64 IoCs

pid	Process
1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
2188	Unicorn-34958.exe
2188	Unicorn-34958.exe
1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
2568	Unicorn-54439.exe
2568	Unicorn-54439.exe
2188	Unicorn-34958.exe
2188	Unicorn-34958.exe
2512	WerFault.exe
2512	WerFault.exe
2512	WerFault.exe
2512	WerFault.exe
2512	WerFault.exe
2748	Unicorn-58881.exe
2748	Unicorn-58881.exe
2668	Unicorn-43099.exe
2668	Unicorn-43099.exe
2568	Unicorn-54439.exe
2568	Unicorn-54439.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1428	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1664	WerFault.exe
1428	WerFault.exe
1664	WerFault.exe
2708	Unicorn-49618.exe
2708	Unicorn-49618.exe
2668	Unicorn-43099.exe
2668	Unicorn-43099.exe
2748	Unicorn-58881.exe
2748	Unicorn-58881.exe
2064	Unicorn-45534.exe
2064	Unicorn-45534.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
2848	WerFault.exe
1264	WerFault.exe
2848	WerFault.exe
2556	Unicorn-29752.exe
2556	Unicorn-29752.exe
2432	Unicorn-8030.exe
2708	Unicorn-49618.exe
2432	Unicorn-8030.exe
2708	Unicorn-49618.exe
2712	Unicorn-57786.exe
2712	Unicorn-57786.exe
2012	Unicorn-16753.exe
2012	Unicorn-16753.exe
2064	Unicorn-45534.exe
2064	Unicorn-45534.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2584	1720	WerFault.exe	27
2512	2188	WerFault.exe	28
1428	2568	WerFault.exe	30
1664	2972	WerFault.exe	29
1264	2748	WerFault.exe	32
2848	2668	WerFault.exe	33
852	2708	WerFault.exe	36
2184	2556	WerFault.exe	37
2216	2064	WerFault.exe	35
2032	2432	WerFault.exe	40
2664	2712	WerFault.exe	41
2564	2740	WerFault.exe	43
3000	2012	WerFault.exe	42
2724	3052	WerFault.exe	46
1568	1276	WerFault.exe	47
2052	1484	WerFault.exe	49
3060	572	WerFault.exe	50
2104	824	WerFault.exe	51
2156	1556	WerFault.exe	55
472	1844	WerFault.exe	57
2132	1368	WerFault.exe	56
1988	1040	WerFault.exe	58
588	2988	WerFault.exe	60
1360	2996	WerFault.exe	61
2036	3020	WerFault.exe	64
1620	612	WerFault.exe	62
1144	2868	WerFault.exe	59
2932	1936	WerFault.exe	63
1336	2776	WerFault.exe	67
1736	2976	WerFault.exe	66
2640	2624	WerFault.exe	73
2520	2480	WerFault.exe	72
1344	2752	WerFault.exe	74
2788	2696	WerFault.exe	71
2720	2532	WerFault.exe	75
1728	2920	WerFault.exe	76
1644	2120	WerFault.exe	78
676	2408	WerFault.exe	81
1160	2912	WerFault.exe	77
2784	1108	WerFault.exe	79
2880	2268	WerFault.exe	80
1096	1944	WerFault.exe	82
3472	2732	WerFault.exe	137
3684	2236	WerFault.exe	86
3688	1256	WerFault.exe	85
3752	2704	WerFault.exe	87
3884	1056	WerFault.exe	91
4080	1900	WerFault.exe	93
4072	1536	WerFault.exe	95
3284	1300	WerFault.exe	100
3440	2620	WerFault.exe	108
3468	2272	WerFault.exe	106
3716	2228	WerFault.exe	102
4032	636	WerFault.exe	94
3608	2800	WerFault.exe	110
3648	2764	WerFault.exe	109
3892	1608	WerFault.exe	105
3972	1612	WerFault.exe	104
3452	1784	WerFault.exe	97
4192	2404	WerFault.exe	103
4276	2940	WerFault.exe	99
4368	2476	WerFault.exe	149
4360	2396	WerFault.exe	151
4392	2516	WerFault.exe	133

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
2188	Unicorn-34958.exe
2568	Unicorn-54439.exe
2972	Unicorn-34573.exe
2748	Unicorn-58881.exe
2668	Unicorn-43099.exe
2064	Unicorn-45534.exe
2708	Unicorn-49618.exe
2556	Unicorn-29752.exe
2432	Unicorn-8030.exe
2712	Unicorn-57786.exe
2012	Unicorn-16753.exe
2740	Unicorn-32535.exe
3052	Unicorn-36462.exe
1276	Unicorn-25877.exe
268	Unicorn-6011.exe
1484	Unicorn-54657.exe
572	Unicorn-50573.exe
824	Unicorn-51128.exe
1556	Unicorn-33298.exe
1368	Unicorn-37382.exe
1844	Unicorn-41466.exe
1040	Unicorn-21600.exe
2988	Unicorn-58549.exe
2996	Unicorn-62633.exe
2868	Unicorn-12877.exe
1936	Unicorn-988.exe
612	Unicorn-33106.exe
3020	Unicorn-24938.exe
2976	Unicorn-40755.exe
2776	Unicorn-41309.exe
2480	Unicorn-32587.exe
2696	Unicorn-32587.exe
2624	Unicorn-12721.exe
2752	Unicorn-20335.exe
2532	Unicorn-3806.exe
2920	Unicorn-20143.exe
2120	Unicorn-24589.exe
2268	Unicorn-48539.exe
2912	Unicorn-44455.exe
1108	Unicorn-28673.exe
2408	Unicorn-16421.exe
1944	Unicorn-40371.exe
2236	Unicorn-35960.exe
1256	Unicorn-35960.exe
2704	Unicorn-3842.exe
1056	Unicorn-35768.exe
1928	Unicorn-27600.exe
1900	Unicorn-27600.exe
636	Unicorn-45560.exe
1304	Unicorn-32238.exe
1536	Unicorn-32238.exe
1300	Unicorn-31492.exe
1884	Unicorn-7864.exe
2940	Unicorn-40214.exe
1784	Unicorn-41475.exe
2856	Unicorn-32046.exe
2228	Unicorn-15841.exe
1612	Unicorn-16395.exe
1608	Unicorn-36261.exe
2684	Unicorn-28839.exe
2764	Unicorn-40537.exe
2404	Unicorn-32177.exe
2272	Unicorn-24009.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2188	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2188	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2188	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	28
PID 1720 wrote to memory of 2188	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	28
PID 2188 wrote to memory of 2568	2188	Unicorn-34958.exe	30
PID 2188 wrote to memory of 2568	2188	Unicorn-34958.exe	30
PID 2188 wrote to memory of 2568	2188	Unicorn-34958.exe	30
PID 2188 wrote to memory of 2568	2188	Unicorn-34958.exe	30
PID 1720 wrote to memory of 2972	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2972	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2972	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2972	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	29
PID 1720 wrote to memory of 2584	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	31
PID 1720 wrote to memory of 2584	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	31
PID 1720 wrote to memory of 2584	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	31
PID 1720 wrote to memory of 2584	1720	e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe	31
PID 2568 wrote to memory of 2748	2568	Unicorn-54439.exe	32
PID 2568 wrote to memory of 2748	2568	Unicorn-54439.exe	32
PID 2568 wrote to memory of 2748	2568	Unicorn-54439.exe	32
PID 2568 wrote to memory of 2748	2568	Unicorn-54439.exe	32
PID 2188 wrote to memory of 2668	2188	Unicorn-34958.exe	33
PID 2188 wrote to memory of 2668	2188	Unicorn-34958.exe	33
PID 2188 wrote to memory of 2668	2188	Unicorn-34958.exe	33
PID 2188 wrote to memory of 2668	2188	Unicorn-34958.exe	33
PID 2188 wrote to memory of 2512	2188	Unicorn-34958.exe	34
PID 2188 wrote to memory of 2512	2188	Unicorn-34958.exe	34
PID 2188 wrote to memory of 2512	2188	Unicorn-34958.exe	34
PID 2188 wrote to memory of 2512	2188	Unicorn-34958.exe	34
PID 2748 wrote to memory of 2064	2748	Unicorn-58881.exe	35
PID 2748 wrote to memory of 2064	2748	Unicorn-58881.exe	35
PID 2748 wrote to memory of 2064	2748	Unicorn-58881.exe	35
PID 2748 wrote to memory of 2064	2748	Unicorn-58881.exe	35
PID 2668 wrote to memory of 2708	2668	Unicorn-43099.exe	36
PID 2668 wrote to memory of 2708	2668	Unicorn-43099.exe	36
PID 2668 wrote to memory of 2708	2668	Unicorn-43099.exe	36
PID 2668 wrote to memory of 2708	2668	Unicorn-43099.exe	36
PID 2568 wrote to memory of 2556	2568	Unicorn-54439.exe	37
PID 2568 wrote to memory of 2556	2568	Unicorn-54439.exe	37
PID 2568 wrote to memory of 2556	2568	Unicorn-54439.exe	37
PID 2568 wrote to memory of 2556	2568	Unicorn-54439.exe	37
PID 2568 wrote to memory of 1428	2568	Unicorn-54439.exe	38
PID 2568 wrote to memory of 1428	2568	Unicorn-54439.exe	38
PID 2568 wrote to memory of 1428	2568	Unicorn-54439.exe	38
PID 2568 wrote to memory of 1428	2568	Unicorn-54439.exe	38
PID 2972 wrote to memory of 1664	2972	Unicorn-34573.exe	39
PID 2972 wrote to memory of 1664	2972	Unicorn-34573.exe	39
PID 2972 wrote to memory of 1664	2972	Unicorn-34573.exe	39
PID 2972 wrote to memory of 1664	2972	Unicorn-34573.exe	39
PID 2708 wrote to memory of 2432	2708	Unicorn-49618.exe	40
PID 2708 wrote to memory of 2432	2708	Unicorn-49618.exe	40
PID 2708 wrote to memory of 2432	2708	Unicorn-49618.exe	40
PID 2708 wrote to memory of 2432	2708	Unicorn-49618.exe	40
PID 2668 wrote to memory of 2712	2668	Unicorn-43099.exe	41
PID 2668 wrote to memory of 2712	2668	Unicorn-43099.exe	41
PID 2668 wrote to memory of 2712	2668	Unicorn-43099.exe	41
PID 2668 wrote to memory of 2712	2668	Unicorn-43099.exe	41
PID 2748 wrote to memory of 2012	2748	Unicorn-58881.exe	42
PID 2748 wrote to memory of 2012	2748	Unicorn-58881.exe	42
PID 2748 wrote to memory of 2012	2748	Unicorn-58881.exe	42
PID 2748 wrote to memory of 2012	2748	Unicorn-58881.exe	42
PID 2064 wrote to memory of 2740	2064	Unicorn-45534.exe	43
PID 2064 wrote to memory of 2740	2064	Unicorn-45534.exe	43
PID 2064 wrote to memory of 2740	2064	Unicorn-45534.exe	43
PID 2064 wrote to memory of 2740	2064	Unicorn-45534.exe	43

C:\Users\Admin\AppData\Local\Temp\e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e7476d5e8d87bbff60e58f0dfc3dcfd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54439.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        10⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        11⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        12⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        13⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
        14⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
        15⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9932 -s 236
        15⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 236
        14⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 216
        13⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 236
        12⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 236
        11⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        10⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        11⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        12⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-141.exe
        13⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-466.exe
        14⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10716 -s 216
        14⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7292 -s 216
        13⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 216
        12⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 216
        11⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 240
        10⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        9⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33612.exe
        10⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        11⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        12⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51900.exe
        13⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10118.exe
        14⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8452 -s 216
        14⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 216
        13⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 216
        12⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 236
        11⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        10⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49419.exe
        11⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        12⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60772.exe
        13⤵
        
        PID:992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 216
        13⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 236
        12⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 236
        11⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 240
        10⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 240
        9⤵
        Program crash
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        9⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        10⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        11⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        12⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        13⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        14⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9512 -s 216
        14⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 216
        13⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 236
        12⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 216
        11⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 236
        10⤵
        Program crash
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9470.exe
        9⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        10⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        11⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        12⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        13⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10420 -s 216
        13⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 216
        12⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 216
        11⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 236
        10⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 240
        9⤵
        Program crash
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 240
        8⤵
        Program crash
        
        PID:588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 236
        7⤵
        Program crash
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51128.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48539.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        9⤵
        Executes dropped EXE
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12101.exe
        10⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27629.exe
        11⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        12⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        13⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        14⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
        15⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10108 -s 220
        15⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 216
        14⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 216
        13⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 216
        12⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 236
        11⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 216
        10⤵
        Program crash
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        9⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        10⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        11⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        12⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        13⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
        14⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8664 -s 216
        14⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 216
        13⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 216
        12⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 216
        11⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12096.exe
        10⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        11⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        12⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37035.exe
        13⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9572 -s 216
        13⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 216
        12⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 236
        11⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 240
        10⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 240
        9⤵
        Program crash
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
        9⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        10⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        11⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
        12⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        13⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        14⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10432 -s 236
        14⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 216
        13⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 216
        12⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 236
        11⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 236
        10⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25806.exe
        9⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2470.exe
        10⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        11⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        12⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        13⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11092 -s 236
        13⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7464 -s 216
        12⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 216
        11⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 216
        10⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 240
        9⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 240
        8⤵
        Program crash
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16421.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        9⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        10⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13186.exe
        11⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32371.exe
        12⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        13⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        14⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10396 -s 216
        14⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 216
        13⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 216
        12⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 236
        11⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 236
        10⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        9⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 240
        10⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 220
        9⤵
        Program crash
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33420.exe
        9⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4463.exe
        10⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60535.exe
        11⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        12⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        13⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11332 -s 216
        13⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 216
        12⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 216
        11⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 216
        10⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 236
        9⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 240
        8⤵
        Program crash
        
        PID:676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 240
        7⤵
        Program crash
        
        PID:2104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 240
        6⤵
        Program crash
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33106.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32177.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
        10⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
        11⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        12⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        13⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        14⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7295.exe
        15⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9820 -s 216
        15⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 216
        14⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 216
        13⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 216
        12⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 216
        11⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        10⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        11⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        12⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 224
        13⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 216
        12⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 216
        11⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 220
        10⤵
        Program crash
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        9⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33228.exe
        10⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        11⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
        12⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        13⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        14⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10220 -s 216
        14⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 216
        13⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 216
        12⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 216
        11⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 236
        10⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 240
        9⤵
        Program crash
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16395.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        9⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        10⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        11⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
        12⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61158.exe
        13⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15656.exe
        14⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9916 -s 216
        14⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 216
        13⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 236
        12⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 236
        11⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 216
        10⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        9⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        10⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        11⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19799.exe
        12⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35884.exe
        13⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9444 -s 216
        13⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 220
        12⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 216
        11⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 236
        10⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 220
        9⤵
        Program crash
        
        PID:3972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 240
        8⤵
        Program crash
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28673.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24009.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16185.exe
        9⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43965.exe
        10⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
        11⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        12⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        13⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23726.exe
        14⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8184 -s 216
        13⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 236
        12⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 216
        11⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 236
        10⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 236
        9⤵
        Program crash
        
        PID:3468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 236
        8⤵
        Program crash
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 240
        7⤵
        Program crash
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-988.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        8⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20426.exe
        9⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        10⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        11⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39736.exe
        12⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59513.exe
        13⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1950.exe
        14⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 216
        14⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 216
        13⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 236
        12⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 216
        11⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        9⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58303.exe
        10⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
        11⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28294.exe
        12⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34623.exe
        13⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9876 -s 216
        13⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 216
        12⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 216
        11⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 236
        10⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 220
        9⤵
        Program crash
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16896.exe
        8⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        9⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24946.exe
        10⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        11⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        12⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        13⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9764 -s 216
        13⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 216
        12⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 216
        11⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 216
        10⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 236
        9⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 240
        8⤵
        Program crash
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24755.exe
        7⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65350.exe
        8⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 240
        9⤵
        Program crash
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6538.exe
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        9⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65200.exe
        10⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        11⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
        12⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9596 -s 216
        12⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 216
        11⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 216
        10⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 216
        9⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 240
        8⤵
        Program crash
        
        PID:3608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 240
        7⤵
        Program crash
        
        PID:2932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 220
        6⤵
        Program crash
        
        PID:3000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48246.exe
        9⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
        10⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6938.exe
        11⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        12⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        13⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        14⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10268 -s 236
        14⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 236
        13⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 236
        12⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 216
        11⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 216
        10⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        9⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        10⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        11⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64126.exe
        12⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37373.exe
        13⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        14⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10648 -s 236
        14⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 216
        13⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 216
        12⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 216
        11⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 236
        10⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 240
        9⤵
        Program crash
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        8⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63487.exe
        9⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        10⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
        11⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        12⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        13⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        14⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9288 -s 216
        14⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 216
        13⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 216
        12⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        11⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-992.exe
        12⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32376.exe
        13⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 216
        13⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 216
        12⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 240
        11⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 236
        10⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41011.exe
        9⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
        10⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37240.exe
        11⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        12⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        13⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11764 -s 216
        13⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 216
        12⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 216
        11⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 216
        10⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 240
        9⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 240
        8⤵
        Program crash
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3842.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        8⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10202.exe
        9⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        10⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        11⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        12⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44249.exe
        13⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7632 -s 220
        13⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 216
        12⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 216
        11⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 216
        10⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        9⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        10⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        11⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4176.exe
        12⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
        13⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12068 -s 216
        13⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        12⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8328 -s 220
        12⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 236
        11⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 216
        10⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 240
        9⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        8⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54214.exe
        10⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34993.exe
        11⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
        12⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8540 -s 216
        12⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 236
        11⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 236
        10⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 236
        9⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 240
        8⤵
        Program crash
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 240
        7⤵
        Program crash
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35960.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        8⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        10⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        11⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52403.exe
        12⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        13⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        14⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 236
        13⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 216
        12⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 236
        11⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 236
        10⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        9⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45688.exe
        10⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26986.exe
        11⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        12⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11431.exe
        13⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11100 -s 236
        13⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 216
        12⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 216
        10⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 240
        9⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        8⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8931.exe
        10⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45543.exe
        11⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21032.exe
        12⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30057.exe
        13⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7964 -s 236
        12⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 216
        11⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 216
        10⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 216
        9⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 240
        8⤵
        Program crash
        
        PID:3684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 216
        7⤵
        Program crash
        
        PID:1336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 240
        6⤵
        Program crash
        
        PID:2724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 236
        5⤵
        Program crash
        
        PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:1428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        10⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        11⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32128.exe
        12⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        13⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        14⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63372.exe
        15⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11120 -s 236
        15⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7556 -s 216
        14⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 216
        13⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 236
        12⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 216
        11⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        10⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35527.exe
        11⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-218.exe
        12⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6975.exe
        13⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15848.exe
        14⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8416 -s 216
        14⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 216
        13⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 236
        12⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 216
        11⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 240
        10⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        10⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40514.exe
        11⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39051.exe
        12⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        13⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-87.exe
        14⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9476 -s 216
        14⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 216
        13⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 216
        12⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 236
        11⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 216
        10⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 240
        9⤵
        Program crash
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
        9⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23415.exe
        10⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        11⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        12⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3607.exe
        13⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30352.exe
        14⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        15⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8188 -s 216
        14⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 216
        13⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 216
        12⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 236
        11⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        10⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64821.exe
        11⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 300
        12⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 236
        11⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 240
        10⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
        9⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        10⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        11⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        12⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        13⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 216
        13⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 216
        12⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 216
        11⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 236
        10⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 220
        9⤵
        Program crash
        
        PID:4072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 240
        8⤵
        Program crash
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        9⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        10⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        11⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        12⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52232.exe
        13⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56501.exe
        14⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 216
        14⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 236
        13⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 216
        12⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 236
        11⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11847.exe
        10⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15813.exe
        11⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21397.exe
        12⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39781.exe
        13⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        14⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7680 -s 216
        13⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 236
        12⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 216
        11⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 220
        10⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        9⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        10⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15615.exe
        11⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
        12⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
        13⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9304 -s 216
        13⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 216
        12⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 236
        11⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 236
        10⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 240
        9⤵
        Program crash
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        8⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
        10⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6876.exe
        11⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        12⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        13⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        14⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 236
        13⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 216
        12⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 216
        11⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 236
        10⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40819.exe
        9⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64665.exe
        10⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        11⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        12⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9192 -s 236
        12⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 216
        11⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 216
        10⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 240
        9⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 240
        8⤵
        Program crash
        
        PID:2640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 240
        7⤵
        Program crash
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20335.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32159.exe
        9⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11676.exe
        10⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31381.exe
        11⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        12⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
        13⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        14⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 216
        13⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 216
        12⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 216
        11⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 236
        10⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        9⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
        10⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53384.exe
        11⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23445.exe
        12⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        13⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 216
        12⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 216
        11⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 216
        10⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 240
        9⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 216
        8⤵
        Program crash
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45560.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        9⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11022.exe
        10⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        11⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23285.exe
        12⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9240 -s 188
        13⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 216
        12⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 216
        11⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 236
        10⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 236
        9⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        9⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        10⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        11⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        12⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8448 -s 216
        12⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6308 -s 216
        11⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 216
        10⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 216
        9⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 240
        8⤵
        Program crash
        
        PID:4032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 240
        7⤵
        Program crash
        
        PID:1988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 240
        6⤵
        Program crash
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        9⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3508.exe
        10⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        11⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 300
        12⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 216
        11⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 236
        10⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 236
        9⤵
        Program crash
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15744.exe
        8⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        9⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        10⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        11⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4183.exe
        12⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        13⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 216
        13⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 216
        12⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 216
        11⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 236
        10⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
        9⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        10⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28880.exe
        11⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52417.exe
        12⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
        13⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7976 -s 216
        12⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 216
        11⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 216
        10⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 240
        9⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 220
        8⤵
        Program crash
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32238.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        8⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
        9⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        10⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        11⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12019.exe
        12⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        13⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9208 -s 216
        13⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 216
        12⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 216
        10⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 216
        9⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21722.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11022.exe
        9⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53695.exe
        10⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        11⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        12⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8292 -s 216
        12⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 216
        11⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 236
        10⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 216
        9⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 240
        8⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 240
        7⤵
        Program crash
        
        PID:472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20143.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31492.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        9⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54416.exe
        10⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        11⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        12⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 320
        13⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 216
        12⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 236
        11⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29335.exe
        10⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 200
        11⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 240
        10⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        9⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        10⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        11⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        12⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44441.exe
        13⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21697.exe
        14⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 216
        13⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 216
        12⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 216
        11⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 236
        10⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 240
        9⤵
        Program crash
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        10⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19892.exe
        11⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        12⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32184.exe
        13⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 236
        12⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 216
        11⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 216
        10⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 216
        9⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 240
        8⤵
        Program crash
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        9⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        10⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12107.exe
        11⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        12⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        13⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9792 -s 220
        13⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 220
        12⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 236
        11⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 216
        10⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 216
        9⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21530.exe
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        9⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        10⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61851.exe
        11⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37218.exe
        12⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11304 -s 216
        12⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 216
        11⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 216
        10⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 236
        9⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 240
        8⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 240
        7⤵
        Program crash
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15841.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65158.exe
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        9⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        10⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45335.exe
        11⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6975.exe
        12⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
        13⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8360 -s 216
        13⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 216
        12⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 216
        11⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 236
        10⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 236
        9⤵
        Program crash
        
        PID:4360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 236
        8⤵
        Program crash
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57924.exe
        8⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
        9⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        10⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        11⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        12⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 216
        11⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 216
        10⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 236
        9⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 236
        8⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 240
        7⤵
        Program crash
        
        PID:1644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 240
        6⤵
        Program crash
        
        PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52906.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        9⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1142.exe
        10⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
        11⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60388.exe
        12⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9232 -s 216
        12⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 216
        11⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 236
        10⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 216
        9⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 216
        8⤵
        Program crash
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46611.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14904.exe
        9⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30380.exe
        10⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        11⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 236
        11⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 216
        10⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 216
        9⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 216
        8⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 240
        7⤵
        Program crash
        
        PID:3452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 236
        6⤵
        Program crash
        
        PID:1360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 240
        5⤵
        Program crash
        
        PID:2664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 240
      4⤵
      Loads dropped DLL
      Program crash
      PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 240
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 240
  2⤵
  - Program crash
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-16753.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
Size 184KB
SHA256 c11afdc5decf956798f12619963c8a6aaeffc901dcd9ae3709754bf0e29021d4
MD5 37d354c679f68a5ee293f84791d03f27
SHA1 c8e152a192917830eca3ed7a614962d9ebb6ab95
SHA512 8345f7fe604375c8199c98ed514f8350fb24cc32784b06e399c1f51805619e2f3a12816d026bace62c7d64cdf36f49eba7e14286237275f9899d9a47bbef5719
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntPhl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gtPhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23285.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23285.exe
Size 184KB
SHA256 de8aaa95078920db6bfe60a0f62d3aae728f9e139d1915a279516a55d7edf164
MD5 bff57fbdcd9a5d6f917f7becc1422150
SHA1 821f839f37aad8d7683a529eae777b7f897ecb36
SHA512 fd961efa3e709c6f54c9b96ad85188486690828e18524ed632a0c7a51b1c5b0fb72bb61f43f761548c21891b80223d37494caaf8393b9669b13d354c418a0f40
SSDEEP 1536:+h+z64Z7ujyEoHx4jK1KzswxrYKyvKc8smdY6xe22wQntchl5hj5ni5pWu:6RTjyEoRQK19Ir5W5gxe2otchlnVirB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29752.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29752.exe
Size 184KB
SHA256 7298f02b59798b4466e105ea9c4a518eb9995877723eb7469611b91ec1d29ecf
MD5 c679f2d3575f846ec7770ee5ffca727e
SHA1 1efa617544f6d2eb936099ad6bf60e06709c3f38
SHA512 e8db72aff212c361e1cb76c31ebb8d58282b3802a5405c694ad9890fdd19b12f4d00af12eeaedc32cdc35251606944da888e9bf781c88ba211f04de0270f4230
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQnt6hl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gt6hlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32535.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32535.exe
Size 184KB
SHA256 d4594b6f595968fcf87eb499fe302ba0967eeb238502ec7bbba722834d1e22f9
MD5 c66ba9f0173a5a9b57f0e56196c55c06
SHA1 6bf0ae556f4c6a22d962e072d659aad2bba5c9a7
SHA512 b97c11de58fafe008f711f2f09126961c9ed371822048a712bee4775779f7295dab1d1cbe40fb95d59033075e2b739926c77e4d1040a85a03bfe20b31631f579
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22wQnt6hl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2ot6hlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40214.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40214.exe
Size 184KB
SHA256 468279e5350b95906c69e4596cdf89beaf167436b85b9fe736602713a1b730a6
MD5 42c1b5dcff2af794c803b182ea0854ab
SHA1 c5f8e9f3bdb615b14116f9d1c0722c0c3777da42
SHA512 974bb58c2a1f136e184cb39cff79cc6b7ed37c4793846c3b0cca8d4d47315ab4238cf50eccbc3ad095a54e5e07c4eeedd20957cacaa64978a218a8faafdb0ffd
SSDEEP 1536:Th+z64Z5ujyEoHx4jK1KzswxrYKyvKc8smdY6xe22wQnt6hl5hj5ni5pWV:FRdjyEoRQK19Ir5W5gxe2ot6hlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40305.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40305.exe
Size 184KB
SHA256 5a6ca4a03d5d3847e68a35142e79c4c59e5681f85f7f79787eb4d93a912f9612
MD5 e3060e38c7f139d26fdfcdcf0be739eb
SHA1 bbee6e6947a02cf2cc1d5c1641c9ee8d813f1fcd
SHA512 5cb5d3cc19f9b4f09e87bcf272c20c4bd0c2cfc09f245ab4bb778fb8b3b1b8894e7099157296b0fce44a33bb9154606e532acc4df7307f1b13299d31ba21f3d1
SSDEEP 1536:xhn564Z5ujyEoHx4jK1KzswxrQKyvLc8smdY6xe22oQntvhl5hj5ni5pWV:TEdjyEoRQK19IrxWggxe2gtvhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40819.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40819.exe
Size 184KB
SHA256 cabb62793b79feb29dcb16b89a8ce8062dd0f1be723f200a29f019cc915ebf35
MD5 7afc3e67b2a52a52607b213b91ce6707
SHA1 20f016f946eca0acefc56423c6d3d6abd3265e09
SHA512 3be0ac5aedd30ff08781ec77478262242ee9ffc3910211d17a5d717ddca9bdd6eb771358fca118f4f08623cd61b51fc49c507b196521039102c11e681297ab08
SSDEEP 1536:th+564Z5ujyEoHx4jK1KzswxrQKyvKc8TmdY6xe22oQntchl5hj5ni5pWV:nDdjyEoRQK19IrxW5Txe2gtchlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50248.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
Size 184KB
SHA256 557dc58339a9e34e36942ea7bd00efe9e5e8bb54f2eab73d969827553f6719f5
MD5 aac4c1d0aa8457b9024fed8db1109239
SHA1 101f78fd3b9ce31b4e4f69b39baef022a4d2b558
SHA512 9a27d44030a26341a9258a5c0cc70e546c47e882ca8daac373c1aec929774062878219e41463bf0aa5e8e8b473ec4a5f6d76fc87fc9de2679bddd48002688f8d
SSDEEP 1536:Fh+564Z5ulyEoHx4jk1KzswxIQKyvKc8smdw6xe22oQntMhl5hj5ni5pWV:PDdlyEoRQk19IIxW5oxe2gtMhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5491.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5491.exe
Size 184KB
SHA256 56dc7ba06a8cabfcd3f9acdbcc9910107d6154799f5415384a4ac1a620890b9b
MD5 fa4eaeb04c657586e9f2bdc0ae90253e
SHA1 26e7b93144e6a12531a6d60f3cd296b3e2309896
SHA512 f71377f5b4537be8f176d8928113e7b53d744d5077e7c86510843ba309c33b6c55dd4fb0598e15f3fe58a8651334a47e9a39ed74988d43a85a66ab296a4be8f4
SSDEEP 1536:bh+z64Z5ujyEoHxhjK1KzswxrQVyvKc8smdY6ze22oQntHhl5hj5ni5pW/:dRdjyEoRxK19IrOW5gze2gtHhlnVirA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-55080.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
Size 184KB
SHA256 28d6daa76b6dc55e803356a9e2598ff880f0a4aa773f2b9e8800b77e409327d4
MD5 327dd34ddf447a4d7a9183e30ad2ef1b
SHA1 27075e6bc2deda2f65b3fff857b315b3661046de
SHA512 a2f1519b5823209dbe624ddcf87d2b1ce587d0dad72af8bf8b85a1c17db91cf70f8068aa33fc337fa9a46a6a8d06ed3f417a21e6267e36f4434b9fa0495e9a6a
SSDEEP 1536:Gh+564Z5uj7EoHx4jK1KzswxrQKyvKc8NmdY6xe22oQntUhl5hj5ni5pWV:yDdj7EoRQK19IrxW5Vxe2gtUhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5786.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
Size 184KB
SHA256 5cc87653b7368f50a160961271436a143d672b7fca7fbd60479f929d72f2f864
MD5 6d0b9b378dbc447034f292124ad03005
SHA1 73931545626b982466874dde60d1bf4dccaf693e
SHA512 acbe88d8966d66d1a1e1afe7fe3603463bbfcab6f030901c8a5e4fd2c960669ec416443d3a917eff624e8db09a621b9b18fd1f403f8189f4c6ea6d357ecc7ac0
SSDEEP 1536:hh+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xed2MQntXhl5hj5ni5pWV:DRdjyEoRQK19IrxW5gxedwtXhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61713.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61713.exe
Size 184KB
SHA256 a6f2de89b955ebd1b9f5155994b3ec8a7a8eab3f6aed68d523ec5227d3c3e471
MD5 bce5e4aaddc33ec997d02b5cf447d09f
SHA1 97c6adb895fc8258ce98848589b86b5c1618e826
SHA512 233cc4f36a1a0d81b6d6cf5c19adb7230ab65c7192c126b9effcf204388d2fffe9d6a8de0e94373ba1f2ac5814934a0002b391866de11f45709c3f986cc212c9
SSDEEP 1536:eh+564Z5ujUEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntLhl5hj5ni5pWV:aDdjUEoRQK19IrxW5gxe2gtLhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6497.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
Size 184KB
SHA256 1b8b31cc31aeeb4da3b9989ead44ee88a7deb1fd4042d520abd7e56b67886a9e
MD5 4e86163fe3fbfdba84974f5ccd43ed26
SHA1 ad93393559ef94cb2e7bdf26e1547a4f39297c85
SHA512 803f122841e06ed8476dac3d6fbd20c08278dee34ac9f8231e8213f9cabd8db46049bb77333ec7f11b89bd5440db42c52dba6a89ed3abf16fde770b9c73bc0c3
SSDEEP 1536:ihn564Z5pjyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntXhl5hj5ni5pWS:WEKjyEoRQK19IrxW5gxe2gtXhlnVirN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-992.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-992.exe
Size 184KB
SHA256 2c815b02ee21c39ffcba00dda54e2d464f27531c4edddcc6a6d30416dbf6aaf7
MD5 3db9126587fec5d9bee4289452ae52e5
SHA1 ef506029a6d4d4bf17f91fd8713c9dd9c693dfef
SHA512 e6d54f2aa9c02c2af4b21653147a33b55bfc7a1a4d8379dda592b582862e795f85c16bbbc32d7624fc94e5e431bb112e476af1e5584b302f9ef0848eb56b595d
SSDEEP 1536:Th+z64Z5ujyEoHx4LK1KzswxrQKyvKc8smdY6xe22oEntwhl5hj5ni5pWY:FRdjyEoRIK19IrxW5gxe20twhlnVirL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34573.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
Size 184KB
SHA256 4e390f3f45a53274b0e1ce0e6495ee7b3468761d9c9076d5ad78339aac8a2c68
MD5 fe03a4ef8944fcd40f9d1a8d4a4f7199
SHA1 c8e02a9ecf2413847afcb924ed34e3f3aac2956d
SHA512 7c301355e3c24fd57e39cab8a443fa71fc46b3756ae67268ee3e6d3be0b1fdce0f0c8e90f4554a2761cf02e2da7eac7db1d0df98812406194d28b8f0a912206f
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntOhl5hjpni5pWV:/RdjyEoRQK19IrxW5gxe2gtOhlnFirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34958.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
Size 184KB
SHA256 3c3b67573cd2e2be5b6ed8538a9307e36e1a1079dfb67da8931db8ec12c2e12d
MD5 b21555ed63db3f8cc2e9790bcac314e8
SHA1 e4c30f245501ff30a98ebf2493d5288f834389f1
SHA512 4ebb9407370581f41a549ef34a7fb908c14a7f9c9e7400faf05ad02a91087af42c849c2c5ce09f05d3d0f5207f4c17dc9935430794fc59fbf512dd2239a4ee52
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntphl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gtphlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43099.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-43099.exe
Size 184KB
SHA256 e1e08f98a2c53b4e7a5cb9ad0b954562b195f042d32033c8aca5763c6f5e16ee
MD5 8a9f46a3051912a2b56e4fab76246943
SHA1 4e705f42926b212e8369a1dccaf89cf1864395f7
SHA512 81669256a1b14527406e01bf9d7ecd1594915693f8ea13329a4a1ccdee91faeb85e5d3be5117bb6e6d03171842460eba4854f25489c1a56490c262b959c4761a
SSDEEP 1536:1h+564Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntphl5hj5ni5pWV:/DdjyEoRQK19IrxW5gxe2gtphlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45534.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
Size 184KB
SHA256 35174ca426a952b96060996fbaf71782de85e03180bd5eaa643922113b5f3eee
MD5 98bae64d0b3f99388d0548256f694562
SHA1 d9d8653bb26f25c91ba27e1dd603e516b0483b39
SHA512 63ba5c9820b1e402721168827fac09e0df2086e4a15dd2ce541032a2d61617f4cdc55c63f6a9b5bbb634c75417e30298ae41c50fac08eb62ba169761f271e96f
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQnt6hl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gt6hlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49618.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
Size 184KB
SHA256 15e25cfefb56814034b2f5c94573419dcf9e43bfb8dc8c2c6fb750f8fe42c5a0
MD5 70a4df0ce3ec94b1c79e2f6da10f8ede
SHA1 268ad47cb46d5f34c31bc04ea55f1b1ca2c11a32
SHA512 0196a6cd91250c5b4d9e416bab7228c319856e434ea3a55da0072e3ae5fe406e09d900e8dbf2a5534eadec4cdd79e291f6e3bf53222825e06e1ffcd939c41bb2
SSDEEP 1536:1h+564Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntYhl5hj5ni5pWV:/DdjyEoRQK19IrxW5gxe2gtYhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54439.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-54439.exe
Size 184KB
SHA256 e2e307b096483ba220ec1a0d25eed685355644081d78d96b813ba5870013b77a
MD5 10ddd06bb80f239d683dabfdf328dba6
SHA1 cd626b881a7737a5edd4d5497ea4b8b486da54b0
SHA512 f04a9775633a4e049b91e866fe2d6a99a86004a056240d61a81e3727ab84b346b945076de5706c5d0cf8b757f4f40f2098f375c2bc6f1291e921c1024ab11593
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntdhl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gtdhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57786.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
Size 184KB
SHA256 49f092a8744ea4d7f0c0cfc848a04cc5c40df62e375712e2c3c447a7a9d9c4e2
MD5 62baa819afd42432d97be7d21c338bba
SHA1 a2f93142a71b0ca7dfbc337eb3d36f4d1cadbc50
SHA512 60b6eb30a1622465af0ccebf6a6d196417c0160c71df0613f52104e10a56ab2f8341e52944f54b932d6bc37abc1463f643f709d38c35b15a7f6d630a52197ad9
SSDEEP 1536:1h+564Z5ujyEoHx4jK1KzswxIQKyvKc8smdY6xe22oQntphl5hj5ni5pWV:/DdjyEoRQK19IIxW5gxe2gtphlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-58881.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-58881.exe
Size 184KB
SHA256 c0f8b61f1624334e5b5f45d660da4a24cca2686d5c701eb52483e62dd40572a6
MD5 ebf2e39b0d4f3bee8e1c42f28fd4b4d3
SHA1 aaf0009f7e46ed04a2ae92c2bb6e6e1f4ca5c23a
SHA512 199f315d2238baa7667a4a4dc048b9a5ac948443dbbbf1154c2a95733fb6c92147c6db69ac7cdc85b8a46ca712c5b8e868bb5b809c86d7b4388269584ed5d691
SSDEEP 1536:1h+z64Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntHhl5hj5ni5pWV:/RdjyEoRQK19IrxW5gxe2gtHhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8030.exe

Path \Users\Admin\AppData\Local\Temp\Unicorn-8030.exe
Size 184KB
SHA256 e04232ca8a02bfc822d4e80f87f15564feb311d952e98de859ffd073eb10a7de
MD5 b69487498e4fd11f7d628244f7ee0510
SHA1 fea7d0aa388481c8185e9c8e89b93112f52e01e0
SHA512 d7757728b9b52c04fb0494baee6e3f3077a38cc39129b0d20c6be86f10c503b2f0e8659bc790d876eac65b9f8c69d0180386096b3cf5b57afaf1ec999ee3dcfc
SSDEEP 1536:1hn564Z5ujyEoHx4jK1KzswxrQKyvKc8smdY6xe22oQntYhl5hj5ni5pWV:/EdjyEoRQK19IrxW5gxe2gtYhlnVirK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads