bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe
Size 192KB
Sample240609-jpazssge82
SHA256 bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3
MD5 0409dd0908a0696a01eafaddcb91457a
SHA1 24f3faa20a01b6c0302c681554f7e2901495275c
SHA512 1085d1ed64015d65c7f68bda70daebe5510ec0ef441c65db08e3b41bb0cf4e72f2ea37e63dd0d650638f360a45a934d2caa30f77009495337fe132de23d766ce
SSDEEP 3072:uV2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/NwPvpFr:uVJooADDgd1DG8T2U2NwPvpF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4400	Unicorn-9462.exe
5004	Unicorn-49639.exe
4864	Unicorn-31034.exe
408	Unicorn-42343.exe
4968	Unicorn-23738.exe
1640	Unicorn-9862.exe
4868	Unicorn-3814.exe
2240	Unicorn-50747.exe
4340	Unicorn-29580.exe
2876	Unicorn-41509.exe
2628	Unicorn-5267.exe
3792	Unicorn-32351.exe
1628	Unicorn-53326.exe
1236	Unicorn-48879.exe
1192	Unicorn-7846.exe
1020	Unicorn-40903.exe
4488	Unicorn-40903.exe
5040	Unicorn-13746.exe
4560	Unicorn-2470.exe
5096	Unicorn-15661.exe
3724	Unicorn-27359.exe
688	Unicorn-3923.exe
3004	Unicorn-7685.exe
3292	Unicorn-34375.exe
1752	Unicorn-2771.exe
4744	Unicorn-63710.exe
3684	Unicorn-48635.exe
3764	Unicorn-48635.exe
3120	Unicorn-40762.exe
2396	Unicorn-40762.exe
2516	Unicorn-59751.exe
4984	Unicorn-56414.exe
464	Unicorn-53887.exe
1348	Unicorn-53887.exe
1568	Unicorn-2418.exe
4620	Unicorn-62247.exe
5044	Unicorn-42106.exe
3804	Unicorn-37468.exe
4360	Unicorn-61095.exe
3300	Unicorn-61095.exe
3228	Unicorn-62356.exe
1592	Unicorn-20447.exe
4356	Unicorn-42682.exe
2824	Unicorn-62548.exe
1920	Unicorn-773.exe
2008	Unicorn-19591.exe
3756	Unicorn-19591.exe
3540	Unicorn-55252.exe
3976	Unicorn-59014.exe
404	Unicorn-46015.exe
3652	Unicorn-15070.exe
3368	Unicorn-47743.exe
3868	Unicorn-36237.exe
4912	Unicorn-56212.exe
4956	Unicorn-15179.exe
4276	Unicorn-55143.exe
2192	Unicorn-46975.exe
4436	Unicorn-30831.exe
5012	Unicorn-55335.exe
1564	Unicorn-45844.exe
2088	Unicorn-49606.exe
5016	Unicorn-597.exe
4948	Unicorn-597.exe
3636	Unicorn-57966.exe

Program crash 43 IoCs

pid	pid_target	Process	procid_target
1892	4620	WerFault.exe	127
5736	4224	WerFault.exe	199
2524	2824	WerFault.exe	135
3396	2668	WerFault.exe	185
1564	4616	WerFault.exe	183
1428	4276	WerFault.exe	150
1504	3116	WerFault.exe	186
4708	5420	WerFault.exe	240
6172	6132	WerFault.exe	233
5824	6068	WerFault.exe	229
6560	6076	WerFault.exe	230
2392	7156	WerFault.exe	279
920	4324	WerFault.exe	281
6524	5600	WerFault.exe	297
1728	3272	WerFault.exe	303
6264	7088	WerFault.exe	298
5388	7128	WerFault.exe	343
5952	5572	WerFault.exe
5980	3904	WerFault.exe	359
1068	7012	WerFault.exe	396
4808	6560	WerFault.exe	382
5220	1840	WerFault.exe	488
6712	1684	WerFault.exe
3804	1292	WerFault.exe	509
912	6500	WerFault.exe	436
6856	4372	WerFault.exe	540
6420	5804	WerFault.exe	545
4608	4884	WerFault.exe	536
2080	2876	WerFault.exe	651
664	5680	WerFault.exe	325
4452	5220	WerFault.exe	603
3652	2192	WerFault.exe	151
3064	3116	WerFault.exe	186
6468	5600	WerFault.exe	701
5624	7076	WerFault.exe	288
396	4056	WerFault.exe
5496	6324	WerFault.exe	722
6576	3468	WerFault.exe	574
6032	3476	WerFault.exe
4868	4760	WerFault.exe	770
7092	5844	WerFault.exe
4124	3804	WerFault.exe	624
5296	5620	WerFault.exe	1045

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe
4400	Unicorn-9462.exe
5004	Unicorn-49639.exe
4864	Unicorn-31034.exe
408	Unicorn-42343.exe
1640	Unicorn-9862.exe
4968	Unicorn-23738.exe
4868	Unicorn-3814.exe
2240	Unicorn-50747.exe
4340	Unicorn-29580.exe
2876	Unicorn-41509.exe
2628	Unicorn-5267.exe
3792	Unicorn-32351.exe
1628	Unicorn-53326.exe
1236	Unicorn-48879.exe
1192	Unicorn-7846.exe
5040	Unicorn-13746.exe
4488	Unicorn-40903.exe
1020	Unicorn-40903.exe
4560	Unicorn-2470.exe
3724	Unicorn-27359.exe
5096	Unicorn-15661.exe
688	Unicorn-3923.exe
3004	Unicorn-7685.exe
3292	Unicorn-34375.exe
1752	Unicorn-2771.exe
4744	Unicorn-63710.exe
3684	Unicorn-48635.exe
3764	Unicorn-48635.exe
2396	Unicorn-40762.exe
3120	Unicorn-40762.exe
2516	Unicorn-59751.exe
4984	Unicorn-56414.exe
464	Unicorn-53887.exe
1348	Unicorn-53887.exe
1568	Unicorn-2418.exe
4620	Unicorn-62247.exe
5044	Unicorn-42106.exe
3804	Unicorn-37468.exe
3300	Unicorn-61095.exe
3228	Unicorn-62356.exe
1592	Unicorn-20447.exe
4360	Unicorn-61095.exe
1920	Unicorn-773.exe
4356	Unicorn-42682.exe
2824	Unicorn-62548.exe
2008	Unicorn-19591.exe
3756	Unicorn-19591.exe
3540	Unicorn-55252.exe
3976	Unicorn-59014.exe
404	Unicorn-46015.exe
3652	Unicorn-15070.exe
3368	Unicorn-47743.exe
3868	Unicorn-36237.exe
4912	Unicorn-56212.exe
4956	Unicorn-15179.exe
4276	Unicorn-55143.exe
2192	Unicorn-46975.exe
4436	Unicorn-30831.exe
5012	Unicorn-55335.exe
1564	Unicorn-45844.exe
2088	Unicorn-49606.exe
5016	Unicorn-597.exe
4948	Unicorn-597.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4400	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	87
PID 3108 wrote to memory of 4400	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	87
PID 3108 wrote to memory of 4400	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	87
PID 4400 wrote to memory of 5004	4400	Unicorn-9462.exe	90
PID 4400 wrote to memory of 5004	4400	Unicorn-9462.exe	90
PID 4400 wrote to memory of 5004	4400	Unicorn-9462.exe	90
PID 3108 wrote to memory of 4864	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	91
PID 3108 wrote to memory of 4864	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	91
PID 3108 wrote to memory of 4864	3108	bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe	91
PID 5004 wrote to memory of 408	5004	Unicorn-49639.exe	95
PID 5004 wrote to memory of 408	5004	Unicorn-49639.exe	95
PID 5004 wrote to memory of 408	5004	Unicorn-49639.exe	95
PID 4400 wrote to memory of 4968	4400	Unicorn-9462.exe	96
PID 4400 wrote to memory of 4968	4400	Unicorn-9462.exe	96
PID 4400 wrote to memory of 4968	4400	Unicorn-9462.exe	96
PID 4864 wrote to memory of 1640	4864	Unicorn-31034.exe	97
PID 4864 wrote to memory of 1640	4864	Unicorn-31034.exe	97
PID 4864 wrote to memory of 1640	4864	Unicorn-31034.exe	97
PID 408 wrote to memory of 4868	408	Unicorn-42343.exe	98
PID 408 wrote to memory of 4868	408	Unicorn-42343.exe	98
PID 408 wrote to memory of 4868	408	Unicorn-42343.exe	98
PID 5004 wrote to memory of 2240	5004	Unicorn-49639.exe	99
PID 5004 wrote to memory of 2240	5004	Unicorn-49639.exe	99
PID 5004 wrote to memory of 2240	5004	Unicorn-49639.exe	99
PID 1640 wrote to memory of 4340	1640	Unicorn-9862.exe	100
PID 1640 wrote to memory of 4340	1640	Unicorn-9862.exe	100
PID 1640 wrote to memory of 4340	1640	Unicorn-9862.exe	100
PID 4864 wrote to memory of 2876	4864	Unicorn-31034.exe	101
PID 4864 wrote to memory of 2876	4864	Unicorn-31034.exe	101
PID 4864 wrote to memory of 2876	4864	Unicorn-31034.exe	101
PID 4968 wrote to memory of 2628	4968	Unicorn-23738.exe	102
PID 4968 wrote to memory of 2628	4968	Unicorn-23738.exe	102
PID 4968 wrote to memory of 2628	4968	Unicorn-23738.exe	102
PID 4868 wrote to memory of 3792	4868	Unicorn-3814.exe	103
PID 4868 wrote to memory of 3792	4868	Unicorn-3814.exe	103
PID 4868 wrote to memory of 3792	4868	Unicorn-3814.exe	103
PID 408 wrote to memory of 1628	408	Unicorn-42343.exe	104
PID 408 wrote to memory of 1628	408	Unicorn-42343.exe	104
PID 408 wrote to memory of 1628	408	Unicorn-42343.exe	104
PID 2240 wrote to memory of 1236	2240	Unicorn-50747.exe	105
PID 2240 wrote to memory of 1236	2240	Unicorn-50747.exe	105
PID 2240 wrote to memory of 1236	2240	Unicorn-50747.exe	105
PID 2876 wrote to memory of 1192	2876	Unicorn-41509.exe	106
PID 2876 wrote to memory of 1192	2876	Unicorn-41509.exe	106
PID 2876 wrote to memory of 1192	2876	Unicorn-41509.exe	106
PID 2628 wrote to memory of 1020	2628	Unicorn-5267.exe	107
PID 2628 wrote to memory of 1020	2628	Unicorn-5267.exe	107
PID 2628 wrote to memory of 1020	2628	Unicorn-5267.exe	107
PID 4340 wrote to memory of 4488	4340	Unicorn-29580.exe	108
PID 4340 wrote to memory of 4488	4340	Unicorn-29580.exe	108
PID 4340 wrote to memory of 4488	4340	Unicorn-29580.exe	108
PID 4968 wrote to memory of 5040	4968	Unicorn-23738.exe	109
PID 4968 wrote to memory of 5040	4968	Unicorn-23738.exe	109
PID 4968 wrote to memory of 5040	4968	Unicorn-23738.exe	109
PID 3792 wrote to memory of 4560	3792	Unicorn-32351.exe	110
PID 3792 wrote to memory of 4560	3792	Unicorn-32351.exe	110
PID 3792 wrote to memory of 4560	3792	Unicorn-32351.exe	110
PID 4868 wrote to memory of 5096	4868	Unicorn-3814.exe	111
PID 4868 wrote to memory of 5096	4868	Unicorn-3814.exe	111
PID 4868 wrote to memory of 5096	4868	Unicorn-3814.exe	111
PID 1628 wrote to memory of 3724	1628	Unicorn-53326.exe	112
PID 1628 wrote to memory of 3724	1628	Unicorn-53326.exe	112
PID 1628 wrote to memory of 3724	1628	Unicorn-53326.exe	112
PID 1236 wrote to memory of 688	1236	Unicorn-48879.exe	113

C:\Users\Admin\AppData\Local\Temp\bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe
"C:\Users\Admin\AppData\Local\Temp\bbb5b48f7c0ea3dcba7ebf17a7b23a28689222b4b99c021e9517befa57ddd4e3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2470.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        9⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46887.exe
        10⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        11⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        12⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        13⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
        14⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11941.exe
        10⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        11⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        12⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        13⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        14⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50374.exe
        9⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        10⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29503.exe
        11⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        12⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
        13⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25127.exe
        14⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4702.exe
        9⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40743.exe
        10⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        11⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        12⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        13⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4270.exe
        14⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46534.exe
        9⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
        10⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        11⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        12⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        13⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46015.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46804.exe
        9⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        10⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
        11⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17228.exe
        12⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        13⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        14⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        15⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        16⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 844
        17⤵
        Program crash
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 844
        16⤵
        Program crash
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58734.exe
        8⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        9⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        10⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
        11⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        12⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        13⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62247.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 488
        8⤵
        Program crash
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        7⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13550.exe
        8⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        9⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        10⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        11⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        12⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        13⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50311.exe
        14⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        9⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31615.exe
        10⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36052.exe
        11⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5878.exe
        12⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        13⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30996.exe
        14⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        10⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54119.exe
        11⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
        12⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        13⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41100.exe
        14⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        15⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
        16⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        17⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        18⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        9⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        10⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        11⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2709.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        9⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        10⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        11⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        12⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        13⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        14⤵
        
        PID:2692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42106.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        8⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        9⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        10⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        11⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
        12⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        13⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25391.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        10⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        11⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20327.exe
        12⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        13⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47743.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        10⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        11⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        12⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        13⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        9⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        10⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50855.exe
        11⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45111.exe
        12⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        13⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
        14⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27372.exe
        15⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        9⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        10⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        11⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34815.exe
        12⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36237.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        8⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14650.exe
        9⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57100.exe
        10⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        11⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        12⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        9⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1462.exe
        10⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        11⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56212.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51028.exe
        8⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42388.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
        10⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
        11⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        12⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        13⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22714.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
        9⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
        10⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        11⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        12⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        13⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
        14⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        15⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        16⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
        17⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48446.exe
        16⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4245.exe
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1547.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        10⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        7⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        9⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        10⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
        11⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        6⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64780.exe
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        9⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27311.exe
        10⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        11⤵
        
        PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        8⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        10⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        11⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        12⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 660
        13⤵
        Program crash
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
        9⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5686.exe
        10⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        11⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        12⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        7⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1734.exe
        9⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64391.exe
        10⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        11⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
        12⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        13⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65143.exe
        8⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3275.exe
        9⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        10⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
        11⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10798.exe
        12⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48563.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        9⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        10⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        11⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54899.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        8⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        9⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24047.exe
        10⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        11⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44343.exe
        12⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43788.exe
        13⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37151.exe
        14⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        15⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        7⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28271.exe
        9⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-341.exe
        10⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        11⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        12⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27447.exe
        13⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 764
        14⤵
        Program crash
        
        PID:4608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 756
        10⤵
        Program crash
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        8⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18183.exe
        9⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62356.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45844.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        8⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        9⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21823.exe
        10⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23471.exe
        11⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        12⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
        13⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18215.exe
        14⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        15⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24226.exe
        16⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        17⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45574.exe
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        9⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        10⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
        11⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31527.exe
        9⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        10⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 852
        10⤵
        Program crash
        
        PID:6524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 756
        9⤵
        Program crash
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54988.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        9⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        10⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        11⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 736
        10⤵
        Program crash
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42682.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34111.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18751.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        9⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        10⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        11⤵
        
        PID:4400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        8⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
        9⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 212
        10⤵
        Program crash
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21178.exe
        8⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65190.exe
        9⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58260.exe
        10⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16943.exe
        11⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        12⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52211.exe
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        8⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58143.exe
        9⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55079.exe
        10⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        11⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        10⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-694.exe
        11⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        12⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        13⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 764
        10⤵
        Program crash
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        7⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        9⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        10⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52319.exe
        11⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        6⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63903.exe
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33831.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        9⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        10⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63071.exe
        11⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        12⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61167.exe
        13⤵
        
        PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55143.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50260.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2891.exe
        9⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55564.exe
        10⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9054.exe
        11⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        12⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        13⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 764
        11⤵
        Program crash
        
        PID:920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 756
        10⤵
        Program crash
        
        PID:5824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 760
        9⤵
        Program crash
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        9⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17711.exe
        10⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
        11⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        12⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 852
        8⤵
        Program crash
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        7⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24319.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        9⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9931.exe
        10⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
        11⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7012 -s 764
        12⤵
        Program crash
        
        PID:1068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 764
        10⤵
        Program crash
        
        PID:2392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 756
        9⤵
        Program crash
        
        PID:6172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 760
        8⤵
        Program crash
        
        PID:3396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 852
        7⤵
        Program crash
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5958.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48084.exe
        10⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58743.exe
        11⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54711.exe
        12⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-622.exe
        13⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-773.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46975.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56223.exe
        9⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        10⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        11⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        12⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        13⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13278.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
        9⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        10⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        6⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23935.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42495.exe
        9⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4166.exe
        10⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        11⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 764
        9⤵
        Program crash
        
        PID:6264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 764
        7⤵
        Program crash
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30586.exe
        6⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9606.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        9⤵
        
        PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4620 -ip 4620
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4224 -ip 4224
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2824 -ip 2824
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2668 -ip 2668
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4616 -ip 4616
1⤵
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3116 -ip 3116
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4276 -ip 4276
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6132 -ip 6132
1⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6068 -ip 6068
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5420 -ip 5420
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6076 -ip 6076
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5540 -ip 5540
1⤵
PID:6224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3412 -ip 3412
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4080 -ip 4080
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5340 -ip 5340
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6084 -ip 6084
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4544 -ip 4544
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7156 -ip 7156
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4324 -ip 4324
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5600 -ip 5600
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3272 -ip 3272
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2112 -ip 2112
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2928 -ip 2928
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7088 -ip 7088
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2492 -ip 2492
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7128 -ip 7128
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5572 -ip 5572
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3904 -ip 3904
1⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\Unicorn-20244.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20244.exe
1⤵
PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 716
  2⤵
  - Program crash
  PID:3804

C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
1⤵
PID:7148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
  2⤵
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16842.exe
    3⤵
    PID:348

C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 640
1⤵
- Program crash
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1788 -ip 1788
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7012 -ip 7012
1⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
1⤵
PID:3000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
  2⤵
  PID:4080

C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37260.exe
1⤵
PID:7152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4524 -ip 4524
1⤵
PID:468

C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36684.exe
1⤵
PID:5240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
  2⤵
  PID:6220

C:\Users\Admin\AppData\Local\Temp\Unicorn-11302.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-11302.exe
1⤵
PID:4220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
  2⤵
  PID:4972

C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39564.exe
1⤵
PID:5868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39484.exe
  2⤵
  PID:2112

C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25077.exe
1⤵
PID:5804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
  2⤵
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 844
  2⤵
  - Program crash
  PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4708 -ip 4708
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4052 -ip 4052
1⤵
PID:5316

C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-16220.exe
1⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5632 -ip 5632
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4720 -ip 4720
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6684 -ip 6684
1⤵
PID:412

C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
1⤵
PID:6404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11414.exe
  2⤵
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 728
    3⤵
    - Program crash
    PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5896 -ip 5896
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6560 -ip 6560
1⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
1⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52099.exe
1⤵
PID:4768

C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 600
1⤵
- Program crash
PID:4808

C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-39951.exe
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5740 -ip 5740
1⤵
PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1684 -ip 1684
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5948 -ip 5948
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2604 -ip 2604
1⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7148 -ip 7148
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 844
1⤵
- Program crash
PID:6712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1292 -ip 1292
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1580 -ip 1580
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
1⤵
PID:6248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
  2⤵
  PID:812

C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59572.exe
1⤵
PID:3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
1⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
1⤵
PID:6012

C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
1⤵
PID:5052

C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
1⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6436 -ip 6436
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6948 -ip 6948
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5096 -ip 5096
1⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\Unicorn-12374.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12374.exe
1⤵
PID:4548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6251.exe
  2⤵
  PID:5236

C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
1⤵
PID:5736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
  2⤵
  PID:6324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 748
    3⤵
    - Program crash
    PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2168 -ip 2168
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1664 -ip 1664
1⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 728
1⤵
- Program crash
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1784 -ip 1784
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6648 -ip 6648
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 636 -ip 636
1⤵
PID:4960

C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
1⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4080 -ip 4080
1⤵
PID:3224

C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-23356.exe
1⤵
PID:6372

C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20943.exe
1⤵
PID:5600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
  2⤵
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
    3⤵
    PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 748
  2⤵
  - Program crash
  PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6596 -ip 6596
1⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
1⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47092.exe
1⤵
PID:6048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44892.exe
  2⤵
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 6384 -ip 6384
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4496 -ip 4496
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3592 -ip 3592
1⤵
PID:5324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2080 -ip 2080
1⤵
PID:4432

C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58716.exe
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5320 -ip 5320
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4768 -ip 4768
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3272 -ip 3272
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1040 -ip 1040
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6248 -ip 6248
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 688 -ip 688
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2928 -ip 2928
1⤵
PID:4760

C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
1⤵
PID:2240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
  2⤵
  PID:6512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-323.exe
    3⤵
    PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
      4⤵
      PID:4524

C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
1⤵
PID:4432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
  2⤵
  PID:1648

C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
1⤵
PID:6696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2876 -ip 2876
1⤵
PID:1432

C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
1⤵
PID:7160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
  2⤵
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
    3⤵
    PID:1656

C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5680 -ip 5680
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6560 -ip 6560
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5220 -ip 5220
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5476 -ip 5476
1⤵
PID:5484

C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
1⤵
PID:4372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
  2⤵
  PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 6672 -ip 6672
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1712 -ip 1712
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 760
1⤵
- Program crash
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 628
1⤵
- Program crash
PID:4452

C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
1⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
1⤵
PID:3612

C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
1⤵
PID:5268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
  2⤵
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3004 -ip 3004
1⤵
PID:6912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5256 -ip 5256
1⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
1⤵
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5736 -ip 5736
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 656
1⤵
- Program crash
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6588 -ip 6588
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 632
1⤵
- Program crash
PID:3064

C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47876.exe
1⤵
PID:6608

C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-46999.exe
1⤵
PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63779.exe
  2⤵
  PID:6672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
    3⤵
    PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5600 -ip 5600
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3094.exe
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7076 -ip 7076
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4328 -ip 4328
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6616 -ip 6616
1⤵
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7076 -s 624
1⤵
- Program crash
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5696 -ip 5696
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6268 -ip 6268
1⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-33084.exe
1⤵
PID:5784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
  2⤵
  PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
    3⤵
    PID:5620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 644
      4⤵
      Program crash
      PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6840 -ip 6840
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6576 -ip 6576
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5924 -ip 5924
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4784 -ip 4784
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 660
1⤵
- Program crash
PID:396

C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
1⤵
PID:6920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
  2⤵
  PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
    3⤵
    PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4712 -ip 4712
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6324 -ip 6324
1⤵
PID:6732

C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
1⤵
PID:3652

C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
1⤵
PID:3868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
  2⤵
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47127.exe
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      4⤵
      PID:6904

C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-811.exe
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe
1⤵
PID:5476

C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
1⤵
PID:6652

C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57687.exe
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4760 -ip 4760
1⤵
PID:6632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3468 -ip 3468
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5844 -ip 5844
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3476 -ip 3476
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 636
1⤵
- Program crash
PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 648
1⤵
- Program crash
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 624
1⤵
- Program crash
PID:6576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 656
1⤵
- Program crash
PID:6032

C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
1⤵
PID:6864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22244.exe
  2⤵
  PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7630.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
      4⤵
      PID:2744

C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
1⤵
PID:7132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
  2⤵
  PID:7028

C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
1⤵
PID:5416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
  2⤵
  PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39447.exe
    3⤵
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55459.exe
        5⤵
        
        PID:6292

C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-19836.exe
1⤵
PID:7096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
  2⤵
  PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41367.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        5⤵
        
        PID:6532

C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
1⤵
PID:6696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
  2⤵
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26972.exe
    3⤵
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57540.exe
      4⤵
      PID:5756

C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
1⤵
PID:5648

C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
1⤵
PID:440

C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
  2⤵
  PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
      4⤵
      PID:3208

C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
1⤵
PID:6076

C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
1⤵
PID:2668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
  2⤵
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
    3⤵
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        5⤵
        
        PID:4176

C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
1⤵
PID:3588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42908.exe
  2⤵
  PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
    3⤵
    PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
      4⤵
      PID:3868

C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
1⤵
PID:5724

C:\Users\Admin\AppData\Local\Temp\Unicorn-57443.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57443.exe
1⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
1⤵
PID:6584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
  2⤵
  PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
    3⤵
    PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
      4⤵
      PID:2876

C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
1⤵
PID:2300

C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-25346.exe
1⤵
PID:936

C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
1⤵
PID:2480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33588.exe
  2⤵
  PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11315.exe
    3⤵
    PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
      4⤵
      PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3804 -ip 3804
1⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-13219.exe
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 488
1⤵
- Program crash
PID:4124

C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
1⤵
PID:3328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
  2⤵
  PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
    3⤵
    PID:7116

C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-45508.exe
1⤵
PID:6556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
  2⤵
  PID:6600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
    3⤵
    PID:1696

C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
1⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
1⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-7246.exe
1⤵
PID:5204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
  2⤵
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
    3⤵
    PID:6676

C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
1⤵
PID:4028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
  2⤵
  PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
    3⤵
    PID:4720

C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
1⤵
PID:6608

C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-8995.exe
1⤵
PID:5064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
  2⤵
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49175.exe
    3⤵
    PID:4708

C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
1⤵
PID:1596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
  2⤵
  PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
    3⤵
    PID:6416

C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
1⤵
PID:1176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
  2⤵
  PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
    3⤵
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51884.exe
      4⤵
      PID:4428

C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
1⤵
PID:5404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
  2⤵
  PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
    3⤵
    PID:5252

C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
1⤵
PID:2572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
  2⤵
  PID:3320

C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-2638.exe
1⤵
PID:4124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
  2⤵
  PID:1788

C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
1⤵
PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
  2⤵
  PID:5300

C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-58108.exe
1⤵
PID:3156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54743.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54743.exe
  2⤵
  PID:4896

C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-56463.exe
1⤵
PID:2512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13518.exe
  2⤵
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20260.exe
    3⤵
    PID:7084

C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
1⤵
PID:6072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
  2⤵
  PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9870.exe
    3⤵
    PID:5520

C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
1⤵
PID:6308

C:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-44652.exe
1⤵
PID:6912
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46103.exe
  2⤵
  PID:4376

C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-51595.exe
1⤵
PID:5956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
  2⤵
  PID:4044

C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-37444.exe
1⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
1⤵
PID:4496

C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-59556.exe
1⤵
PID:6460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
  2⤵
  PID:5668

C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-21020.exe
1⤵
PID:6268

C:\Users\Admin\AppData\Local\Temp\Unicorn-52623.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-52623.exe
1⤵
PID:5408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
  2⤵
  PID:3236

C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
1⤵
PID:3252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
  2⤵
  PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5620 -ip 5620
1⤵
PID:4524

C:\Users\Admin\AppData\Local\Temp\Unicorn-30999.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-30999.exe
1⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
1⤵
PID:5328

C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-32644.exe
1⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
1⤵
PID:5448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
  2⤵
  PID:1464

C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-54276.exe
1⤵
PID:6440

C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
1⤵
PID:5160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
  2⤵
  PID:1764

C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
1⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49180.exe
1⤵
PID:3636

C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-40820.exe
1⤵
PID:5776
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
  2⤵
  PID:2544

C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
1⤵
PID:7068

C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-49372.exe
1⤵
PID:1880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41796.exe
  2⤵
  PID:5968

C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
1⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
1⤵
PID:5972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-13746.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
Size 192KB
SHA256 137ff00a3f0239edb93e62cdefb9383f4e42eab5290ffcb952201896ee5bf6d4
MD5 ad81f2f61ad86f69ccb006f9226254dd
SHA1 fcf8292d8158f81d04956aed9291afad35ae7267
SHA512 48196725a382fb90a0300e88efbc8c6b0dfdd93545a8d67cc97f235ad501d6e21df1d69c93bb35d30d49d23c83b5c7985796b60ed0d0f08f2aa4609da7ca558b
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsCPP/NwPvpFr:uSJooADDgd1DG8T2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15661.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15661.exe
Size 192KB
SHA256 eebd4d1860015105c3276a4e39eb047c4df5ac043157ff4731b37dd4bfdf82c8
MD5 f7490fa9e34ac2ab62e6aedd384ae171
SHA1 e8a2152c6ecc33b698d88d30ee1805d271a6a031
SHA512 2ed64e9f363c767e59c80906c302b81ba9e1b4ebffe90c94a600fe3f32147b0f8f98d7cf30068a6f17c9c8d417bcab3126e5d52a1032facbc0616b656741ae00
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd61ABi5EFxsMPP/NwPvpFr:uSJooADDgd1DG8r012NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19591.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
Size 192KB
SHA256 09b651eb66a6317b9ba00a113297d6b7d17eead7d8bca7d11febd87f23529d6b
MD5 c98e38c8c15a362b50a3f491724a378c
SHA1 ca1b1f4273fe5e58cf215c7ce45fa282f7ee7f35
SHA512 0928340412b45aaf07fa70098f4552cc3b7728c46a38adba1a5b4bc0c94c98ea02807fd1754c62fff51484416b2781477632657334254cb0832e82671b13cc86
SSDEEP 3072:MS2ooXKCKFiDD2g0dfNDG8z99Zl6dALi0EFxsCPP/NwPvpFr:MSJoqADDgd1DG8b2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2251.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2251.exe
Size 192KB
SHA256 444e0a1bcafd6f4ee5c2e2fdbc033cb991380f838ee9df1b0743c4fade052d02
MD5 acdd14e3974d7fce084fe9ef4c81bfac
SHA1 c4daaa8e812a4b105ba5d87c22d53b127a9bdc56
SHA512 fe30fe65326584c024cb36e8b95423bf84f5e70b25958f5e244416dee6aed83780cd076973ce10cdc1de82d7a375b26091dfda041720ff2010f6ee43807e896a
SSDEEP 3072:dS2ooXKCIFiDD/g0dfHDG8z9BZI61ALi5EFxsMPP/NwPvpFr:dSJooADDLdvDG8M212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23738.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23738.exe
Size 192KB
SHA256 aa0a42dfc5f4ff17f3b35b8877ccb75885217a826ef831b41061f22af6d74946
MD5 540ff90cd3082080b192ea36d3946058
SHA1 6f3c6d8ae03e96f8ee42936bb09e2d6a9bb59743
SHA512 5e0bfeecaff97b17c23cc2455c36fb720320d314e35d15ca70df8ad40aead9af521477acb536475e46bafdd1cf1255d50ba8622f60a7414488f85bef6c90d483
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsCPP/NwPvpFr:uSJooADDgd1DG8T2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2470.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2470.exe
Size 192KB
SHA256 267dffdd809072c3e6732cf2971064d25a62b73b7af1ce03e05f69a204bf2244
MD5 3bc536826b0072b8ca91da8bd609f6e5
SHA1 a214d17bd3db09af19efa9204fdc8eebc3799f38
SHA512 c7e18049df005360b69e8de468951abc02e2e20e734c20088cce2226a7c6faeb5c765197214d1f772d7e479b0c4cf83cb73663bcef5c3cab99011f7485cb1ebf
SSDEEP 3072:uS2ooXKCIFiDD2g0dfHDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJooADDgdvDG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27359.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27359.exe
Size 192KB
SHA256 e33079e1f7797e9de117bfbd2647053f9bcfc2aa8c8d8660331adf3e2e017773
MD5 ef0aeb0a2f3d428ce04710cd9b5bc453
SHA1 b70e85c18f184b3742748bb2e94ac8c21efca1b3
SHA512 fbe8f04c1e21827a141710b04d1f739b1b05f8207d8bbbef931a6c737b386255a7400a45560c039f2bc7a7a618dd808e99c62cc03064953d8808b560a3e19a8c
SSDEEP 3072:uS2ooXKCWFiDD2g0dfNDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJo2ADDgd1DG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2771.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
Size 192KB
SHA256 a871a0f8e9c6e8d31e2df629e82e33510497e99afef1c4f09302fa8e9f8b96bc
MD5 821dfc3aa80141aff9fa13a313c1a11e
SHA1 6aa38d9ee376e57eba2ca70158811ee6cf015e15
SHA512 620de378145a160da6ae86ab4ada9a645c2fb0b643f3dafb7e262be280f82fd750f32a844edbfddbb4c941af2da69f98ffcc412c24adabd63fd4de270cd9c765
SSDEEP 3072:cV2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:cVJooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29580.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29580.exe
Size 192KB
SHA256 26477fd97477df0722228dbda0f00392a1f00bea245931f3e25befd7df983052
MD5 60a9a809d8844119f157144bfca2a3ef
SHA1 bc5a316e8eb049a9f7f76a808a44f89a726da286
SHA512 9a9707a9f85efffc706342366b76602cf728167db5a379a339557c2e807992e32f271e961c11bdb500fd83a58cf811b3a3a457e38054e23247fdea8c8765d7ca
SSDEEP 3072:uV/ooXKCIFiDD2gKdfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:uVwooADDOd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3086.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3086.exe
Size 192KB
SHA256 940a211fd8d3103cdb070585a0274ad8dec0f7b311a1a8725dc9171ac59c3a36
MD5 513ba19a4a9267aaa82c8d37f38c189a
SHA1 74b4959d5e5128d8454137ce0476cf6a4916fa5e
SHA512 db8890b945861d62dbd5cf17e70cb0a8dba9616224ae92fee321b9eb14a82ab2f7e9931c3a784bb9637e6f303914cc648ed61a15b99ef73ed5ebb52a70e4260f
SSDEEP 3072:GSAooXrCIjiDD/g0dfHDG8o9oZd61ALi5fFxsDW4oNwPvpFr:GSroR2DDLdvDG8B2iINwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31034.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
Size 192KB
SHA256 63cd423bc9a8be489fd1e1e323032f4240d0b94b398c1f4d62808f8d326b6ff8
MD5 2c006a2fa4cd3a701f9278a88bc4553a
SHA1 07c8eac81bc46b79fe57bb3293107ffac5825ab0
SHA512 86a4b86abef573160ae7cc5ba87e67e8661112715428c85a3e3aea07b860e986d4e3a7d211c8376d91ec82e12b206bcad574ae8ee2cd94b7d7187b460405d829
SSDEEP 3072:uV2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:uVJooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32351.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
Size 192KB
SHA256 694dea26abd4477f583859ddfa210e9eb26daf9f5cf9a7f104ee91671be7137f
MD5 f5695f7a9ed7d52c74675c7d10a521d2
SHA1 8b4aafad76e33eef43a05d6a8a7b50db96b7f370
SHA512 42948d690b0a0dead4adb0a9734d7d6d60b87887d713832a4e766c7931cd9cb9c8649643ed37399eda5a2cfdb711cbcc65029cd580ccfdf75d04a709ba1119da
SSDEEP 3072:uS2ooXKCIFiDD2g0dfHDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJooADDgdvDG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-34375.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
Size 192KB
SHA256 f78eaabe1f9ec3a990a229fe011e83ed9cd157d7f18d2b9f215744be42672219
MD5 f892997fbfcb4ed0cd3be2eb267b48ed
SHA1 b3c55f7f4f6b8f3da5f8df20b765f3a61b7ed1d8
SHA512 afc7c6cb66b308692d23d171b1b60b1619c20bd344bfd3ccb254ba8ba59027ab93243ddc14c510390b877f23c273c8ddd47c04747ab2dfe23e3a2ccdb61a5eb4
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDv8z99Zd6dALi0EFxsCPP/NwPvpFr:uSJooADDgd1Dv8T2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3654.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3654.exe
Size 192KB
SHA256 29feb1317a139f214c0d30ff550fdb5568b442e3299f753f6ec77e5a268fae42
MD5 43cc9a0d6d9047577322a370db77550b
SHA1 b19da495bc0bbff83641788958334ca0c8ede056
SHA512 603b37e15b882ac15e4f96fde678e430be5400bbf5f89511371b17984a419875b355e9c537cd490964b3b237c9e6f2565673f09abbb8637a0dc74dd0dcf8cd01
SSDEEP 3072:8S2ooXICIFiDD2g0dfHDG8z99Zd61ALi5iFxsMP3/NwPvpFr:8SJo2ADDgdvDG8r2zeNwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3814.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3814.exe
Size 192KB
SHA256 bcbf166533ae3650dc85929f346b63e297836014024daa8bf41877b353b46be1
MD5 3a21f1bbc1335ade1b17b520b143bc6b
SHA1 9d020ff75aa4324b2bbd112a9e880dcf4ac1c9a4
SHA512 a3739d2a8c21c9d377d6a0a02b6e82f2b80b42f2b049a1edac69e2ad98d38861459c21cd52f9b6e257a6651298863e11d116d3e232c6d8c64fa2457b37e02d1f
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJooADDgd1DG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3923.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
Size 192KB
SHA256 b029b62b6a1d2ee3a5cc7a731b684353f2f11d0769ec8405b09878bfbdd8063d
MD5 5181173753bf4e72199869b10bf3a54a
SHA1 4ed3750a30d4c512288c6066f6b22a6974cd2ecb
SHA512 5c5e8a6d193b66ecaf9e6267f6bf589fe8c72b7ba282f01062f7a40f8c6d689a34474c07d0557af6eefcee290119b815221cb4c5bc98eb46f7491d2beeb6806e
SSDEEP 3072:uS2ooXwCIFiDD2g0dfNDG8z99Zd6dALiFEFxsMPP/NwPvpFr:uSJoOADDgd1DG8T2J2NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40762.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
Size 192KB
SHA256 9b2f8b40a4b3c1857416df809b42c7731c309f89c8f498b057bdd3f4111ea2d5
MD5 c176e30f87b3e78c55999965ab203437
SHA1 ffaf936dcd594b4e95d23c9ac59ae00285f1ab05
SHA512 11d39b59b4ac4f6d1f1ab0d3fa08ab773f3dd7d32f779776ee9628e29a2cd38896da44bb082a4409a37ee5b444f3c87b852adf210fe448c139f76c72fa3032a0
SSDEEP 3072:MS2ooXKCIFiDD2g0dfNDG8z99Zl6dALi0EFxsCPP/NwPvpFr:MSJooADDgd1DG8b2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40903.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
Size 192KB
SHA256 aa519a5b760e9c2f3902e22db0a86d64c9b3464c91f068a293bdfab76c53a7fc
MD5 d3a63df2c3d6390dc8ce0bee6577b36d
SHA1 31538871137bb32c71c9042b2c4d1a39b807d77a
SHA512 f78dd018a2b8c60c956e6f09731bd15400ff0af8c0c8931913807fc12bb7d0698a71924c3e86d9af8a4b0e10ea4d96aaa1d38fa8d43cb18c90d9080fc4faa16f
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zl6dALi0EFxsCPP/NwPvpFr:uSJooADDgd1DG8b2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-41509.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-41509.exe
Size 192KB
SHA256 dffe6ebe096470d48fe23c6e137575ad0cb17e6c25ce7ab7044be22663a5ee68
MD5 a6c02a7fe83869d533a86e6b3efaf3a5
SHA1 2fc44dfd72591691b8de9b4128ea9e2e69314989
SHA512 73c8074fbe29a86200a6074bab230afea0d7cfa427248840f5051c5c85f9a90d81d03e2f70e5900161131e7363d691e2459a1ae422b5ffe68b0aca50fecae6ab
SSDEEP 3072:PV2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:PVJooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42343.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
Size 192KB
SHA256 0d0ee9b1698703be947972bda52c6992dffc204d1b9d3936bc68f06898848f3e
MD5 ba575e5a13da183305fc9ed59e478d3f
SHA1 83843065cccfda4fdab6ca0f41fd630e213e9945
SHA512 b1daeba7d3458c437775ab7ddd47fcc8ec213b6b873e06b7ed22d54e17de5dfdeb0900c690478b8b93bd8c7935b5efb61127e5a44894c00ba4f4ddc883116934
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJooADDgd1DG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44892.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44892.exe
Size 192KB
SHA256 8b2903cc8e122a6a64b7d6c590a1c5d85a24053a349e73ad3ebe62088b8db798
MD5 601316f1742f176afc44f23370d4b072
SHA1 b4c8a562cb497855393c7a6aaf89e0532ea1b1e1
SHA512 cb8aa8c252b4144fcb53058a36bf9431e4547a1f114a6fea58c308a742a761fa1812f7381cec3398e11bb7fc28f2c178199703f360cf9855d5a2258bbdc5ca3b
SSDEEP 3072:WS2ooSK1IhiDg2gAdsNDG8z97Zd6uttiTEFxsCPP/NwPvpFr:WSJoYEDgkdMDG8Twj8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46327.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
Size 192KB
SHA256 65f3cd78b99ebb1097d8faa1f2bab603cb09cb046e58e9594bc588c30f1325aa
MD5 60255f9a7743c6595a52c051f40b2818
SHA1 a55f2eb352eec6deafebf229afd6ca966f48cdac
SHA512 f205266f6a958a266ea054e0f9f853c875173ac0fffdfc8dc1c46b59d0bad9c3ae6a485d693c9724b59ef137f784617786af92b8cd1e314ef4d35ce9e240ed69
SSDEEP 3072:UV2ooXKCIFiDD2g0dfyDG8z99Zd6dA8i0EFxsMPK/EwPvpFr:UVJooADDgdqDG8T7UFEwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48635.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48635.exe
Size 192KB
SHA256 ff399fbb59e30c93a54078da8807c70ffd633fc69c96910b9490c9b47e38bb7a
MD5 90b6fcaa90ec5352ddd3db64bea59003
SHA1 a07868bb2eaa8e87f110c7c3c7e4fb98ec739fe9
SHA512 484933062cfdd92b47fe1bac3e213bc2b0e426617023a8f6c277d65a4dea56ee3ade664cefb3419ed13b3deb9ab175aa672804b5ada9522728ec7a44891b2360
SSDEEP 3072:PV2WoXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:PVrooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48879.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
Size 192KB
SHA256 4ecdfdeba5c31d69beebaa57c2c09e8c041034d42039432c6535308ad292484b
MD5 c9cdd8aab52ba3df8366f24b76e66b51
SHA1 38d7589766a908cc022e6d85649e315cd5f62619
SHA512 45b3ed8088d222163c99817530f949da60f1b99e69b6446a542a383ed81358f94ebdd89d75979a742ccb5d4d97879d68a31483a8e0fae6bb5b9346e901b11b2b
SSDEEP 3072:uS2ooXwCIFiDD2g0dfNDG8z99Zd6dALiFEFxsMPP/NwPvpFr:uSJoOADDgd1DG8T2J2NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49639.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
Size 192KB
SHA256 5675f7741c3f81c646d34399358baec41617052f3c340961f4a8521245b6af63
MD5 584586614358c03dfe61abef83efd9e8
SHA1 7acea3f01f989e8aa522612761d551c396d1cb21
SHA512 98a8204f18b675c03833a090e303ff81000447c9f33f6d97b4a934875cb918f2b60ec3025fab99a3fe1a0983cc8c7ce2b20139633dc1f7ac5981af46c9760e62
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd6dALi5EFxsMPP/NwPvpFr:uSJooADDgd1DG8T212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50204.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe
Size 192KB
SHA256 e9b5a6ca015ba2aab8f158133bfeec9172cfb39b1e4369c016913887298f078b
MD5 633c3733e56dd502a05c04dada26ec4b
SHA1 897075ad13b9b756d9566bd7bbe3dac5a27ca0f3
SHA512 78156784cb37be4aaf664394ada15cc9a5fa8d989f9811dc0b31e566e3f60aff1b0e922ac16f65f4170cda78e7db48b943aa4b3b2549dc1a6844bf2c4b525b3e
SSDEEP 3072:kSfooXwCI7iDD2g0dfNDT8z92Zd6NALiCEFxs+PgvNwPvpFr:kSQoOuDDgd1DT8q2mZNwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50747.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50747.exe
Size 192KB
SHA256 da71a241bf178a5f12058cfdbf6131a871553ce792a3d8bed26c515cf66d6a97
MD5 4b0d18bebeeb37386c280c4df9e2eb09
SHA1 8589a169e03016503760da78d532a192943a2622
SHA512 def00c034705dd816d868440ce388869495927b61f3de463fb3626ec477f23cb2696f8cfdfef58dfb4a89e57ea886b53b040179f4e73a2043677a85fcb837a01
SSDEEP 3072:uS2ooXwCIFiDD2g0dfNDG8z99Zd6dALi5EFxsMPP/NwPvpFr:uSJoOADDgd1DG8T212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52308.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52308.exe
Size 192KB
SHA256 054c87b12d2816380b0822982e74185dbe8081dc9f7f732904c958ef99ece841
MD5 b5d42ee6bd8007ee6cf0d4ff4717e24f
SHA1 d90673cc9abec3299c5b5e677e5c62ad75e78715
SHA512 f81660402b7d43939ad562caac35d44df4bcbe1342f8e1712b740ea8a96956ec165a376e32872de34fc0179bceac319978216d4b11ac5ceb33a7a3433efcde62
SSDEEP 3072:nN2poXwCIFiDD2g0dfYDG8zy9Zd6dALiFSFxgMPP/NwPvpFr:nNIoOADDgdQDG8o2j2NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5267.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
Size 192KB
SHA256 8ed32b99e0081f487c50d2f1dea5b3bf22c43f45ac5caa7dbc0766b88ce3e8e1
MD5 2694fcdd91fb3ad8dd3b8cbf509773d2
SHA1 5830bdc14da62cb962857425453e41357fad8b06
SHA512 7153f0a4d48b41617fc1d7e0802b2ee1f665516f278e882356d8e25799a7cd01fd88c430fa474532a550c41960be8f19bde5e0f43a7fd1478c8f3adc7980936f
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsCPP/NwPvpFr:uSJooADDgd1DG8T2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53326.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
Size 192KB
SHA256 af34dffd294b3d3cc8b88e1e4446e89751cbc6d180c4fa0b58882ebe7141db7f
MD5 3a7ac70776e2dcc5019a151a6168bc40
SHA1 48d8e8c13ba629ce06a1153e3b9569099b015d90
SHA512 64ef72a258ae636b5631a70f44ceba36a6ee43ab9d42985cd7371b5f4db79a00ce7a95b43294741999c0ff1c789b5ff91b879e689ceddd1c9a3e895de13c0aff
SSDEEP 3072:uS2ooXKCWFiDD2g0dfNDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJo2ADDgd1DG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56414.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
Size 192KB
SHA256 de6c3227be8fc923e2b2f6e5aa7d145f5722a2f36fe7a79b928c85c056508635
MD5 2bafb1b23a90db059308200a76d4f7fb
SHA1 28b65a7b064cb21ee25f984079e1dde324eada16
SHA512 8639af51a64b3cdbb91e2d7eb4ba2e69abb923e5188e75e1ff491789e92f32fe7c18c829095b3a1de62af3dcca0c60d006e3eaf88f9990e4717928b0b55dd402
SSDEEP 3072:uS2ooXKCIFHDD2g0dfHDG8z99Zd61ALi5EFxsMPP/NwPvpFr:uSJoo1DDgdvDG8r212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5702.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5702.exe
Size 192KB
SHA256 2c324fd990d75acd313a43e1eecae3a6ebefa230e982407c346b64111a5f2023
MD5 98b467ba939af7e6662fbbbb1fdbd9d3
SHA1 5f499273f62f9e20b80f9127c6e4569f70b39d61
SHA512 a0301212709a5b3030a8d3a7fb0fb936759c7f3a50bfcc9d01671ad5ae33829f4f3085620d3f7b746824d8892849ef0840cd16094bcfec1c4121ad271421308e
SSDEEP 3072:KSAooXrCIFiDD/g0dfHDG8z99Zd61ALi5EFxsDPPoNwPvpFr:KSroRADDLdvDG8r21MNwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59479.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
Size 192KB
SHA256 b85ab4dc995621851245db8184a63be3f6229641dc8df0f72b8207cf09bc8659
MD5 0b313dab6c8fcc9c42f33ffa9e2f01cd
SHA1 60d2bc891cf3d7b6d2c8d5a5a75b44927e4afb96
SHA512 296923a7000f66179ab987f22aa7fcdbe7904a533c49bd30fcfcda875baddd6ae837af9725f8fc43523337a07a0f8cbcc2821e3ec166e582c0129f56ab53c90c
SSDEEP 3072:47booXKoWFiFP2g0dfNDG8z9nZN61ALi5EFxsMPi/NwPvpFc:47coIAFPgd1DG8F21dNwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59751.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
Size 192KB
SHA256 5bb0630d71c3c7d9d3126a0caf6dbaab94ef265c4f248e380cf7dae363fadd9e
MD5 f36659e5a9e13a497fcbd6a799abb76d
SHA1 7dd6f70df149afdc9b28d5e885237cc30f2418d5
SHA512 fb59aa3a99f715221f99cde8022e59dbd3319ed7a35dd9a218b78db3b7d84fe68dd455f0beedc1fafd7651e0ccc57ab17f3496581589a5d4ceebe4e5b68f650b
SSDEEP 3072:uS2ooXKCIFiDD2g0dfHDG8z99Zd61ALi5EFxsMP3/NwPvpFr:uSJooADDgdvDG8r21eNwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63710.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63710.exe
Size 192KB
SHA256 11bbda420760de821f3e1774a84400789c1a0343bf88988f5127e1cef987f481
MD5 4758a9bc64b9650f257958a614812262
SHA1 7c721822d8bd8d76cf46a990ffbfce07f4381787
SHA512 9cd61ea6399f2aa41c6e83c31c7f276d210105d2446600b6203fa9562824cdfd4837f92792e7bc2bec7571687e263cefb1809bbd1a1fec3e1210df3cb392a9c4
SSDEEP 3072:uS2ooXKCIFiDD2grdfNDG8z99Zd6dALi0EFxsCPP/NwPvpFr:uSJooADD/d1DG8T2U8NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7685.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
Size 192KB
SHA256 422af3837f39bcfbf74cfb3cb5ae79e0bb535471dd46431c4a8ea402636ed370
MD5 dfeded45a5cf45c75562bbda7e9c8ea9
SHA1 39f16842fdb2d16dc459ee901cd0af4081bfe650
SHA512 3d5e0bd223df3b1f7f804a34609824d72ba768b09d3d8f1f2090dd89748d2f230191edde86b430022f4d24af3fb7e71a7cd7698c93c259958b4e9f2f643ed6ef
SSDEEP 3072:uS2ooXwCIFiDD2g0dfNDG8z99id6dALi5EFxsMPP/NwPvpFr:uSJoOADDgd1DG8C212NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-7846.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
Size 192KB
SHA256 68abf6da3738f817ab51cc2604e859c02ef5b515e7f995c201e64f84760d3ea7
MD5 ae58761c818b694c7e8f371dffa722a3
SHA1 9286db5039876d80593a8f946b8b8a99500799f0
SHA512 dd86c30585bae0a6813c0352d06ee15bfe568499e53b2b58832ee396eaad3dc03e7ad488cf9ea38faa42153cb093c2ff2c1deb0edfa7d9de193ec7a40de09885
SSDEEP 3072:cV2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:cVJooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9462.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
Size 192KB
SHA256 443469fb5a097ff1ad1d36bef3c807bcf89cb12d86098befffa7a3fb0f08cc93
MD5 8888748cf5d9998686f06d46f5826341
SHA1 22775b57f317c0d9545daa0f65f17771516186bd
SHA512 fd2049abc2975f6f53569884395a1a9ef2e841ee34d7693fb15c2c5fdba11e9fb8a5a9f32aa2e5de6d5bd1f1d4f96ffc03eacb83343c54fd6d9ac1503e840e1c
SSDEEP 3072:uS2ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/NwPvpFr:uSJooADDgd1DG8T2U2NwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9862.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
Size 192KB
SHA256 28d509dd514dc18fe0179138e1daff26ef06db08ce7eb1580853976d85217229
MD5 b5fe84cdec1b0c794053382ae460e7fe
SHA1 21d0b3a9c89e51ce4083ece7c92ef8abaf005f17
SHA512 afdcacf0972bb262489f218140b8b9757270963daa19b1b52c6a51fcf2ab7d37bb27452d1dfe9dfceb7d48b1b41e604350d9f0e82d0d2e2d300427d6ebffdb95
SSDEEP 3072:uV/ooXKCIFiDD2g0dfNDG8z99Zd6dALi0EFxsMPP/EwPvpFr:uVwooADDgd1DG8T2U2EwPvpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads