78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f

Analysis

max time kernel
149s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
Size

468KB
MD5

c8013aaac2f36bf885ff313ba6312496
SHA1

67201bbee091afda911a962e37b19c9ae27137c7
SHA256

78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f
SHA512

974f2c1b072c45e2f8d720e6e333abf581433581d78a442ea21847f24487f4ade4e73bb4440b1212933f78d8f3859470f646d60d4e68faf01574504be005e94b
SSDEEP

3072:iOAoogIdId5CtbYiYztjcf8/qCtvPTpShmHeLVUGtO78Q/HPBtlx:iObowbCtNYJjcfMNiVtOoWHPB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3124	Unicorn-58440.exe
4968	Unicorn-32722.exe
3852	Unicorn-47667.exe
3328	Unicorn-5285.exe
3920	Unicorn-55041.exe
800	Unicorn-9369.exe
4116	Unicorn-3239.exe
2852	Unicorn-49992.exe
2360	Unicorn-27242.exe
2256	Unicorn-57968.exe
4648	Unicorn-7376.exe
3332	Unicorn-15544.exe
3520	Unicorn-29279.exe
3620	Unicorn-39494.exe
716	Unicorn-8502.exe
1812	Unicorn-40646.exe
1560	Unicorn-63759.exe
2580	Unicorn-4465.exe
4548	Unicorn-65156.exe
3552	Unicorn-47444.exe
4084	Unicorn-59504.exe
4912	Unicorn-32862.exe
3960	Unicorn-12996.exe
1016	Unicorn-36946.exe
936	Unicorn-44849.exe
1284	Unicorn-38984.exe
4284	Unicorn-25248.exe
3132	Unicorn-23516.exe
3136	Unicorn-7734.exe
5084	Unicorn-52772.exe
3720	Unicorn-54434.exe
4352	Unicorn-57703.exe
2620	Unicorn-61787.exe
824	Unicorn-37904.exe
3740	Unicorn-1917.exe
3056	Unicorn-6001.exe
1728	Unicorn-44896.exe
1276	Unicorn-40812.exe
4892	Unicorn-22338.exe
4132	Unicorn-61040.exe
4104	Unicorn-61595.exe
2208	Unicorn-6993.exe
1836	Unicorn-15658.exe
2276	Unicorn-48688.exe
4564	Unicorn-13877.exe
3992	Unicorn-142.exe
1832	Unicorn-12859.exe
464	Unicorn-31888.exe
428	Unicorn-16944.exe
1356	Unicorn-36387.exe
4056	Unicorn-31334.exe
4804	Unicorn-342.exe
4660	Unicorn-63814.exe
4164	Unicorn-61868.exe
1436	Unicorn-23528.exe
2384	Unicorn-23550.exe
1596	Unicorn-56314.exe
1600	Unicorn-9159.exe
3596	Unicorn-41640.exe
924	Unicorn-56606.exe
4544	Unicorn-64774.exe
1852	Unicorn-23833.exe
3480	Unicorn-32102.exe
2100	Unicorn-42962.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2624	1560	WerFault.exe	110
1028	3520	WerFault.exe	106
4920	4968	WerFault.exe	92
1448	4648	WerFault.exe	104
4808	3920	WerFault.exe	96
1880	4968	WerFault.exe	92
2556	4648	WerFault.exe	104
1124	3520	WerFault.exe	106
1852	3920	WerFault.exe	96
4420	4548	WerFault.exe	115
4560	4548	WerFault.exe	115
2700	4284	WerFault.exe	125
4968	3332	WerFault.exe	105
2936	4284	WerFault.exe	125
2824	3332	WerFault.exe	105
2624	1728	WerFault.exe	155
772	3056	WerFault.exe	153
4304	1276	WerFault.exe	154
4740	4104	WerFault.exe	159
4284	1728	WerFault.exe	155
5152	4544	WerFault.exe	187
5144	3056	WerFault.exe	153
5784	1276	WerFault.exe	154
7708	1436	WerFault.exe	181
7552	5576	WerFault.exe	231
6156	6812	WerFault.exe	334
6504	2632	WerFault.exe	206
7964	3960	WerFault.exe	119
5252	6064	WerFault.exe	282
9380	6648	WerFault.exe	326
9768	7312	WerFault.exe	392
9740	4548	WerFault.exe	364
10000	5988	WerFault.exe	366
9504	5376	WerFault.exe	371
9648	7320	WerFault.exe	393
9760	7080	WerFault.exe	360
9692	7916	WerFault.exe	405
6424	7240	WerFault.exe	388
9596	7328	WerFault.exe	394
9336	6756	WerFault.exe	333
9404	6632	WerFault.exe	377
9592	7684	WerFault.exe	401
10320	6460	WerFault.exe	415
7660	6732	WerFault.exe	376
6888	6964	WerFault.exe	354
9940	6968	WerFault.exe	357
10652	5664	WerFault.exe	257
10952	5592	WerFault.exe	232
10944	3552	WerFault.exe	116
10936	2580	WerFault.exe	114
10928	3016	WerFault.exe	214
10916	5360	WerFault.exe	259
10644	5500	WerFault.exe	251
10636	464	WerFault.exe	173
10624	4056	WerFault.exe	176
10568	6212	WerFault.exe	448
10560	4968	WerFault.exe	209
10552	1832	WerFault.exe	172
11188	7268	WerFault.exe	423
5996	6216	WerFault.exe	308
12800	1956	WerFault.exe	210
12324	6564	WerFault.exe	345
11940	4104	WerFault.exe	296
11340	2924	WerFault.exe	300

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56314.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
3124	Unicorn-58440.exe
4968	Unicorn-32722.exe
3852	Unicorn-47667.exe
3920	Unicorn-55041.exe
3328	Unicorn-5285.exe
800	Unicorn-9369.exe
4116	Unicorn-3239.exe
2852	Unicorn-49992.exe
2360	Unicorn-27242.exe
2256	Unicorn-57968.exe
716	Unicorn-8502.exe
4648	Unicorn-7376.exe
3332	Unicorn-15544.exe
3520	Unicorn-29279.exe
3620	Unicorn-39494.exe
1812	Unicorn-40646.exe
4548	Unicorn-65156.exe
3552	Unicorn-47444.exe
4084	Unicorn-59504.exe
4912	Unicorn-32862.exe
3960	Unicorn-12996.exe
1016	Unicorn-36946.exe
1284	Unicorn-38984.exe
4284	Unicorn-25248.exe
936	Unicorn-44849.exe
3132	Unicorn-23516.exe
3136	Unicorn-7734.exe
5084	Unicorn-52772.exe
3324	Unicorn-60656.exe
3720	Unicorn-54434.exe
4352	Unicorn-57703.exe
2620	Unicorn-61787.exe
824	Unicorn-37904.exe
3740	Unicorn-1917.exe
1728	Unicorn-44896.exe
1276	Unicorn-40812.exe
3056	Unicorn-6001.exe
4132	Unicorn-61040.exe
4892	Unicorn-22338.exe
4104	Unicorn-61595.exe
2208	Unicorn-6993.exe
2276	Unicorn-48688.exe
4564	Unicorn-13877.exe
3992	Unicorn-142.exe
1836	Unicorn-15658.exe
1832	Unicorn-12859.exe
464	Unicorn-31888.exe
1356	Unicorn-36387.exe
428	Unicorn-16944.exe
4056	Unicorn-31334.exe
4804	Unicorn-342.exe
2992	Unicorn-48033.exe
4660	Unicorn-63814.exe
1436	Unicorn-23528.exe
4164	Unicorn-61868.exe
2384	Unicorn-23550.exe
1596	Unicorn-56314.exe
1600	Unicorn-9159.exe
3596	Unicorn-41640.exe
924	Unicorn-56606.exe
1852	Unicorn-23833.exe
4544	Unicorn-64774.exe
3480	Unicorn-32102.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3124	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	87
PID 1744 wrote to memory of 3124	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	87
PID 1744 wrote to memory of 3124	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	87
PID 3124 wrote to memory of 4968	3124	Unicorn-58440.exe	92
PID 3124 wrote to memory of 4968	3124	Unicorn-58440.exe	92
PID 3124 wrote to memory of 4968	3124	Unicorn-58440.exe	92
PID 1744 wrote to memory of 3852	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	93
PID 1744 wrote to memory of 3852	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	93
PID 1744 wrote to memory of 3852	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	93
PID 4968 wrote to memory of 3328	4968	Unicorn-32722.exe	95
PID 4968 wrote to memory of 3328	4968	Unicorn-32722.exe	95
PID 4968 wrote to memory of 3328	4968	Unicorn-32722.exe	95
PID 3124 wrote to memory of 3920	3124	Unicorn-58440.exe	96
PID 3124 wrote to memory of 3920	3124	Unicorn-58440.exe	96
PID 3124 wrote to memory of 3920	3124	Unicorn-58440.exe	96
PID 3852 wrote to memory of 800	3852	Unicorn-47667.exe	97
PID 3852 wrote to memory of 800	3852	Unicorn-47667.exe	97
PID 3852 wrote to memory of 800	3852	Unicorn-47667.exe	97
PID 1744 wrote to memory of 4116	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	98
PID 1744 wrote to memory of 4116	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	98
PID 1744 wrote to memory of 4116	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	98
PID 3328 wrote to memory of 2852	3328	Unicorn-5285.exe	101
PID 3328 wrote to memory of 2852	3328	Unicorn-5285.exe	101
PID 3328 wrote to memory of 2852	3328	Unicorn-5285.exe	101
PID 3920 wrote to memory of 2360	3920	Unicorn-55041.exe	102
PID 3920 wrote to memory of 2360	3920	Unicorn-55041.exe	102
PID 3920 wrote to memory of 2360	3920	Unicorn-55041.exe	102
PID 800 wrote to memory of 2256	800	Unicorn-9369.exe	103
PID 800 wrote to memory of 2256	800	Unicorn-9369.exe	103
PID 800 wrote to memory of 2256	800	Unicorn-9369.exe	103
PID 4968 wrote to memory of 4648	4968	Unicorn-32722.exe	104
PID 4968 wrote to memory of 4648	4968	Unicorn-32722.exe	104
PID 4968 wrote to memory of 4648	4968	Unicorn-32722.exe	104
PID 3852 wrote to memory of 3332	3852	Unicorn-47667.exe	105
PID 3852 wrote to memory of 3332	3852	Unicorn-47667.exe	105
PID 3852 wrote to memory of 3332	3852	Unicorn-47667.exe	105
PID 3124 wrote to memory of 3520	3124	Unicorn-58440.exe	106
PID 3124 wrote to memory of 3520	3124	Unicorn-58440.exe	106
PID 3124 wrote to memory of 3520	3124	Unicorn-58440.exe	106
PID 4116 wrote to memory of 3620	4116	Unicorn-3239.exe	107
PID 4116 wrote to memory of 3620	4116	Unicorn-3239.exe	107
PID 4116 wrote to memory of 3620	4116	Unicorn-3239.exe	107
PID 1744 wrote to memory of 716	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	108
PID 1744 wrote to memory of 716	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	108
PID 1744 wrote to memory of 716	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	108
PID 2852 wrote to memory of 1812	2852	Unicorn-49992.exe	109
PID 2852 wrote to memory of 1812	2852	Unicorn-49992.exe	109
PID 2852 wrote to memory of 1812	2852	Unicorn-49992.exe	109
PID 3328 wrote to memory of 1560	3328	Unicorn-5285.exe	110
PID 3328 wrote to memory of 1560	3328	Unicorn-5285.exe	110
PID 3328 wrote to memory of 1560	3328	Unicorn-5285.exe	110
PID 716 wrote to memory of 2580	716	Unicorn-8502.exe	114
PID 716 wrote to memory of 2580	716	Unicorn-8502.exe	114
PID 716 wrote to memory of 2580	716	Unicorn-8502.exe	114
PID 1744 wrote to memory of 4548	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	115
PID 1744 wrote to memory of 4548	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	115
PID 1744 wrote to memory of 4548	1744	78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe	115
PID 2256 wrote to memory of 3552	2256	Unicorn-57968.exe	116
PID 2256 wrote to memory of 3552	2256	Unicorn-57968.exe	116
PID 2256 wrote to memory of 3552	2256	Unicorn-57968.exe	116
PID 2360 wrote to memory of 4084	2360	Unicorn-27242.exe	117
PID 2360 wrote to memory of 4084	2360	Unicorn-27242.exe	117
PID 2360 wrote to memory of 4084	2360	Unicorn-27242.exe	117
PID 3332 wrote to memory of 4912	3332	Unicorn-15544.exe	118

C:\Users\Admin\AppData\Local\Temp\78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe
"C:\Users\Admin\AppData\Local\Temp\78e0eb893431960bd723998744a855fc1d6e9932e0a17773ef26fcb48926f28f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40646.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23516.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        9⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
        10⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        11⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56087.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        11⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        12⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        12⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        12⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 640
        11⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        9⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 752
        9⤵
        Program crash
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63575.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        9⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 636
        11⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 656
        10⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31757.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31054.exe
        9⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32486.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        8⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 636
        9⤵
        Program crash
        
        PID:9380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 756
        8⤵
        Program crash
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        9⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        7⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 640
        8⤵
        Program crash
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20977.exe
        7⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        9⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        9⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55766.exe
        10⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        9⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60991.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        8⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 624
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10866.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        8⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 636
        8⤵
        Program crash
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36933.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59388.exe
        8⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19985.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        7⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9927.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32652.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36326.exe
        9⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        10⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60140.exe
        11⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        12⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        11⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53679.exe
        10⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        11⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        10⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26486.exe
        9⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        10⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        11⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        11⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18753.exe
        9⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        9⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        10⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54272.exe
        9⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42718.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        9⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        9⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        9⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
        8⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        7⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8712 -s 464
        8⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33498.exe
        9⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        10⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16410.exe
        11⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        12⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        11⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46513.exe
        10⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18779.exe
        10⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        10⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30072.exe
        9⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 724
        8⤵
        Program crash
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1022.exe
        7⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 644
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
        8⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 636
        7⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        5⤵
        Executes dropped EXE
        
        PID:1560
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 220
        6⤵
        Program crash
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31334.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
        8⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        9⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        10⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        11⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1775.exe
        12⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exe
        10⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        10⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40379.exe
        10⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        9⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
        9⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62190.exe
        9⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
        10⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        9⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53232.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46155.exe
        8⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 716
        7⤵
        Program crash
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57929.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10861.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37800.exe
        9⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29496.exe
        9⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57482.exe
        9⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        8⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 760
        8⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5280 -s 760
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        9⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57151.exe
        9⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        8⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        9⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53024.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39533.exe
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35605.exe
        7⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22834.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-955.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        9⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30892.exe
        9⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37307.exe
        6⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        7⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21298.exe
        8⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 644
        9⤵
        Program crash
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        9⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8936.exe
        9⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        9⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        9⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2584.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52538.exe
        9⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        9⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-820.exe
        8⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63294.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        7⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
        6⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 636
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57614.exe
        6⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        5⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63224.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52556.exe
        5⤵
        
        PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 724
        5⤵
        Program crash
        
        PID:1448
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 724
        5⤵
        Program crash
        
        PID:2556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 756
      4⤵
      Program crash
      PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 756
      4⤵
      Program crash
      PID:1880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6001.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 632
        7⤵
        Program crash
        
        PID:772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 632
        7⤵
        Program crash
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        6⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6812 -s 220
        9⤵
        Program crash
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8972.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        8⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        8⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 632
        9⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43000.exe
        9⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 628
        7⤵
        Program crash
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        6⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        7⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63757.exe
        8⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4031.exe
        7⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63316.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24670.exe
        7⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42358.exe
        6⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35894.exe
        5⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31858.exe
        6⤵
        
        PID:6692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 660
        6⤵
        Program crash
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26000.exe
        6⤵
        
        PID:5864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 724
      4⤵
      Program crash
      PID:4808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 744
      4⤵
      Program crash
      PID:1852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 724
      4⤵
      Program crash
      PID:1028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 724
      4⤵
      Program crash
      PID:1124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56606.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25060.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58106.exe
        9⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        9⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 656
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        7⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 668
        7⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7933.exe
        6⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16680.exe
        8⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52003.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46514.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        6⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 636
        6⤵
        Program crash
        
        PID:6888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 624
        5⤵
        
        PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
      4⤵
      PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
        5⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        6⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        7⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        5⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28662.exe
        6⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
        5⤵
        
        PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48408.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38698.exe
        5⤵
        
        PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13450.exe
      4⤵
      PID:13584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6993.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
    3⤵
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36238.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26372.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        8⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47867.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55074.exe
        6⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        7⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        6⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        7⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        6⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
        5⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        6⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        5⤵
        
        PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4935.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13015.exe
        6⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64214.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        7⤵
        
        PID:9740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 636
        5⤵
        
        PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
      4⤵
      PID:8696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8696 -s 436
        5⤵
        
        PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
      4⤵
      PID:11776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
      4⤵
      PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        6⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32118.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53991.exe
        7⤵
        
        PID:9428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 624
        5⤵
        
        PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      4⤵
      PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
      4⤵
      PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
        5⤵
        
        PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    3⤵
    PID:6732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 640
      4⤵
      Program crash
      PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1932.exe
    3⤵
    PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63387.exe
    3⤵
    PID:11684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10970.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        8⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 748
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56772.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 628
        9⤵
        Program crash
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24484.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52024.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        10⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 648
        10⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35230.exe
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        10⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
        9⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
        10⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
        9⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        10⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57518.exe
        8⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        8⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 736
        7⤵
        Program crash
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4181.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24541.exe
        6⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7328 -s 640
        7⤵
        Program crash
        
        PID:9596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 740
        6⤵
        Program crash
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        9⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        10⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
        11⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        10⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65380.exe
        9⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18750.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        9⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        9⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        9⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56750.exe
        7⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 780
        7⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        6⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49917.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9485.exe
        7⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24645.exe
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33659.exe
        7⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
        6⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14271.exe
        7⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        7⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56314.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7981.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19134.exe
        7⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 632
        7⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        6⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8904 -s 632
        7⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        6⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24245.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 636
        7⤵
        Program crash
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43014.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        6⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5703.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        6⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        7⤵
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        5⤵
        
        PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 720
        6⤵
        Program crash
        
        PID:2624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 736
        6⤵
        Program crash
        
        PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        6⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 648
        7⤵
        Program crash
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        5⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39912.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        9⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6911.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        7⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 616
        7⤵
        
        PID:4480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 648
        5⤵
        Program crash
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 644
        7⤵
        Program crash
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17664.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        6⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 636
        7⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2662.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        5⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        6⤵
        
        PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22338.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32102.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59704.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47810.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        9⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7268 -s 724
        10⤵
        Program crash
        
        PID:11188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 744
        9⤵
        Program crash
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1453.exe
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 720
        9⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46124.exe
        9⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 624
        8⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14591.exe
        6⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7240 -s 648
        7⤵
        Program crash
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13798.exe
        6⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        6⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
        7⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44717.exe
        5⤵
        
        PID:2632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 648
        6⤵
        Program crash
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52370.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41090.exe
        7⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8068 -s 752
        7⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8068 -s 752
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        6⤵
        
        PID:9540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 652
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        5⤵
        
        PID:5820
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 636
        6⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        5⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        6⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
        5⤵
        
        PID:3920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 744
      4⤵
      Program crash
      PID:4968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 764
      4⤵
      Program crash
      PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 724
        6⤵
        Program crash
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9112.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18675.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31770.exe
        6⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7936 -s 616
        7⤵
        
        PID:1556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 656
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32657.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        5⤵
        
        PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55786.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46793.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62372.exe
        9⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42730.exe
        8⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        8⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37006.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57774.exe
        8⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
        7⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        6⤵
        
        PID:9512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 672
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        5⤵
        
        PID:6632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 724
        6⤵
        Program crash
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
        5⤵
        
        PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52396.exe
      4⤵
      PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
      4⤵
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9403.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        5⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        6⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        5⤵
        
        PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28267.exe
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
      4⤵
      PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        5⤵
        
        PID:11772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
      4⤵
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50742.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63331.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29445.exe
        5⤵
        
        PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32028.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
      4⤵
      PID:5812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 764
      4⤵
      PID:13224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39066.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 716
        7⤵
        Program crash
        
        PID:10568
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 660
        6⤵
        Program crash
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        6⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54716.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45859.exe
        5⤵
        
        PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        6⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8272 -s 640
        7⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        6⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62832.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45641.exe
        5⤵
        
        PID:5252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 736
      4⤵
      Program crash
      PID:10560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6226.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
      4⤵
      PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      4⤵
      PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        5⤵
        
        PID:9636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15243.exe
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25938.exe
    3⤵
    PID:10680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 636
        6⤵
        Program crash
        
        PID:4304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 636
        6⤵
        Program crash
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61595.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 632
        5⤵
        Program crash
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60280.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59870.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 640
        6⤵
        Program crash
        
        PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57930.exe
      4⤵
      PID:6528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 628
        5⤵
        
        PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35852.exe
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
      4⤵
      PID:12068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 636
      4⤵
      Program crash
      PID:2700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 680
      4⤵
      Program crash
      PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48688.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17520.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      4⤵
      PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45676.exe
      4⤵
      PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        5⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
      4⤵
      PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        5⤵
        
        PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36041.exe
      4⤵
      PID:13356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      4⤵
      PID:1620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        5⤵
        
        PID:7080
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7080 -s 648
        6⤵
        Program crash
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        5⤵
        
        PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64831.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        5⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51645.exe
        5⤵
        
        PID:13072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 644
      4⤵
      Program crash
      PID:12800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40026.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
    3⤵
    PID:7312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 636
      4⤵
      Program crash
      PID:9768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
    3⤵
    PID:8228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
    3⤵
    PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56150.exe
      4⤵
      PID:5524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8502.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe
    3⤵
    - Executes dropped EXE
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60656.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14395.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41012.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        8⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 636
        9⤵
        Program crash
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        7⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7744 -s 724
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35641.exe
        7⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 644
        7⤵
        Program crash
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        6⤵
        
        PID:8504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 756
        6⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8021.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        6⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 640
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        6⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48993.exe
        5⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39030.exe
        6⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53836.exe
        5⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        6⤵
        
        PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 640
        6⤵
        Program crash
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41156.exe
        5⤵
        
        PID:5376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 636
        6⤵
        Program crash
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8317.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32769.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        5⤵
        
        PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59974.exe
        5⤵
        
        PID:5396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 632
        6⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54385.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5951.exe
        5⤵
        
        PID:6844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 684
      4⤵
      Program crash
      PID:10936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61787.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24510.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64603.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57072.exe
        7⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16397.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        6⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62090.exe
        5⤵
        
        PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21656.exe
        5⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        6⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37280.exe
        5⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        6⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32849.exe
      4⤵
      PID:9188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 708
      4⤵
      PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63954.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36024.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        6⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61898.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        5⤵
        
        PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45241.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        5⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        6⤵
        
        PID:10252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 636
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
      4⤵
      PID:12080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57644.exe
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        6⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17894.exe
        7⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        5⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
        6⤵
        
        PID:1960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5500 -s 636
      4⤵
      Program crash
      PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
      4⤵
      PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29928.exe
        5⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58080.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        7⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        
        PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        5⤵
        
        PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-113.exe
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
      4⤵
      PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
    3⤵
    PID:8684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9057.exe
    3⤵
    PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35154.exe
      4⤵
      PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 628
    3⤵
    - Program crash
    PID:4420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 652
    3⤵
    - Program crash
    PID:4560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41640.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40846.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57685.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52382.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24884.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6170.exe
        5⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        6⤵
        
        PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60939.exe
      4⤵
      PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25424.exe
        5⤵
        
        PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
    3⤵
    PID:7684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 636
      4⤵
      Program crash
      PID:9592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
  2⤵
  PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47888.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4390.exe
        6⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        7⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        6⤵
        
        PID:5252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 648
        5⤵
        Program crash
        
        PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54624.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        5⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
        5⤵
        
        PID:9788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 684
      4⤵
      PID:13440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
      4⤵
      PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:10756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 716
      4⤵
      PID:10696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
    3⤵
    PID:8692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8692 -s 436
      4⤵
      PID:10976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17192.exe
    3⤵
    PID:11428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
  2⤵
  PID:6420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
  2⤵
  PID:7864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 540
    3⤵
    PID:11276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
  2⤵
  PID:9640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
  2⤵
  PID:12104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
    3⤵
    PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1560 -ip 1560
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3520 -ip 3520
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4648 -ip 4648
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4968 -ip 4968
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3920 -ip 3920
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4648 -ip 4648
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4968 -ip 4968
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3520 -ip 3520
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3920 -ip 3920
1⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4548 -ip 4548
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4548 -ip 4548
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4284 -ip 4284
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3332 -ip 3332
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4284 -ip 4284
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3332 -ip 3332
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3056 -ip 3056
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1728 -ip 1728
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1276 -ip 1276
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4104 -ip 4104
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2208 -ip 2208
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3992 -ip 3992
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1016 -ip 1016
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 800 -ip 800
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2208 -ip 2208
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3992 -ip 3992
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1016 -ip 1016
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 800 -ip 800
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4544 -ip 4544
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1728 -ip 1728
1⤵
PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3056 -ip 3056
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1276 -ip 1276
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4104 -ip 4104
1⤵
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4920 -ip 4920
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5844 -ip 5844
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5244 -ip 5244
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2632 -ip 2632
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1448 -ip 1448
1⤵
PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4920 -ip 4920
1⤵
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5224 -ip 5224
1⤵
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5244 -ip 5244
1⤵
PID:6488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2632 -ip 2632
1⤵
PID:6872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5844 -ip 5844
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5392 -ip 5392
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1448 -ip 1448
1⤵
PID:6304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2528 -ip 2528
1⤵
PID:6448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5428 -ip 5428
1⤵
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5756 -ip 5756
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5952 -ip 5952
1⤵
PID:6592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5576 -ip 5576
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1436 -ip 1436
1⤵
PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3720 -ip 3720
1⤵
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5224 -ip 5224
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5604 -ip 5604
1⤵
PID:6956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 712 -ip 712
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2348 -ip 2348
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5524 -ip 5524
1⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5188 -ip 5188
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5400 -ip 5400
1⤵
PID:7564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5888 -ip 5888
1⤵
PID:7604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5808 -ip 5808
1⤵
PID:7780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5192 -ip 5192
1⤵
PID:7944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6812 -ip 6812
1⤵
PID:8036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5392 -ip 5392
1⤵
PID:8132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2852 -ip 2852
1⤵
PID:8164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6420 -ip 6420
1⤵
PID:8184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2528 -ip 2528
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5428 -ip 5428
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2788 -ip 2788
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1600 -ip 1600
1⤵
PID:7184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3480 -ip 3480
1⤵
PID:7388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5440 -ip 5440
1⤵
PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5320 -ip 5320
1⤵
PID:7296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3960 -ip 3960
1⤵
PID:7924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4544 -ip 4544
1⤵
PID:7804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5756 -ip 5756
1⤵
PID:7732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5952 -ip 5952
1⤵
PID:7760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5604 -ip 5604
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3720 -ip 3720
1⤵
PID:7864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 712 -ip 712
1⤵
PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2348 -ip 2348
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5188 -ip 5188
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5400 -ip 5400
1⤵
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5888 -ip 5888
1⤵
PID:7964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 5524 -ip 5524
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5192 -ip 5192
1⤵
PID:6912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5808 -ip 5808
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6064 -ip 6064
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 2852 -ip 2852
1⤵
PID:7404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1600 -ip 1600
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5440 -ip 5440
1⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3480 -ip 3480
1⤵
PID:7792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2788 -ip 2788
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5320 -ip 5320
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3960 -ip 3960
1⤵
PID:7664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 6312 -ip 6312
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6624 -ip 6624
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 6148 -ip 6148
1⤵
PID:8188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5340 -ip 5340
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5796 -ip 5796
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6596 -ip 6596
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6568 -ip 6568
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6804 -ip 6804
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6720 -ip 6720
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 6328 -ip 6328
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6296 -ip 6296
1⤵
PID:7884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6552 -ip 6552
1⤵
PID:8460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5776 -ip 5776
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5824 -ip 5824
1⤵
PID:9016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 2596 -ip 2596
1⤵
PID:9144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6064 -ip 6064
1⤵
PID:8884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6756 -ip 6756
1⤵
PID:9020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6648 -ip 6648
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6260 -ip 6260
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6360 -ip 6360
1⤵
PID:7760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6692 -ip 6692
1⤵
PID:9144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 2212 -ip 2212
1⤵
PID:9264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6868 -ip 6868
1⤵
PID:9324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 2112 -ip 2112
1⤵
PID:9388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 7280 -ip 7280
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1020 -ip 1020
1⤵
PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 7236 -ip 7236
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6528 -ip 6528
1⤵
PID:9724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5728 -ip 5728
1⤵
PID:9852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5636 -ip 5636
1⤵
PID:9936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5476 -ip 5476
1⤵
PID:10088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6024 -ip 6024
1⤵
PID:10200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 4232 -ip 4232
1⤵
PID:7736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5628 -ip 5628
1⤵
PID:7788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 5256 -ip 5256
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6252 -ip 6252
1⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6276 -ip 6276
1⤵
PID:8468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 7328 -ip 7328
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 7240 -ip 7240
1⤵
PID:9248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 7916 -ip 7916
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7080 -ip 7080
1⤵
PID:9264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 7320 -ip 7320
1⤵
PID:9532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 5376 -ip 5376
1⤵
PID:9472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5988 -ip 5988
1⤵
PID:9584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4548 -ip 4548
1⤵
PID:9448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 7312 -ip 7312
1⤵
PID:9796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5632 -ip 5632
1⤵
PID:10172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6968 -ip 6968
1⤵
PID:9724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6964 -ip 6964
1⤵
PID:10196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6732 -ip 6732
1⤵
PID:10100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6632 -ip 6632
1⤵
PID:9232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 7684 -ip 7684
1⤵
PID:9344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 6312 -ip 6312
1⤵
PID:9292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6624 -ip 6624
1⤵
PID:10116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6148 -ip 6148
1⤵
PID:10064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6460 -ip 6460
1⤵
PID:9396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1832 -ip 1832
1⤵
PID:9248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 4968 -ip 4968
1⤵
PID:10216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6212 -ip 6212
1⤵
PID:10280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 464 -ip 464
1⤵
PID:10340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5664 -ip 5664
1⤵
PID:10516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 5500 -ip 5500
1⤵
PID:10604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6568 -ip 6568
1⤵
PID:10680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4056 -ip 4056
1⤵
PID:10720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 5360 -ip 5360
1⤵
PID:10876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3016 -ip 3016
1⤵
PID:11072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2580 -ip 2580
1⤵
PID:9264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 3552 -ip 3552
1⤵
PID:10316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 5592 -ip 5592
1⤵
PID:10748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5796 -ip 5796
1⤵
PID:10720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 4132 -ip 4132
1⤵
PID:10504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6720 -ip 6720
1⤵
PID:11520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6328 -ip 6328
1⤵
PID:11756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6596 -ip 6596
1⤵
PID:12004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 824 -ip 824
1⤵
PID:12272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5100 -ip 5100
1⤵
PID:11464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6552 -ip 6552
1⤵
PID:11432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5776 -ip 5776
1⤵
PID:12364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 5296 -ip 5296
1⤵
PID:12440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 6804 -ip 6804
1⤵
PID:12592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4560 -ip 4560
1⤵
PID:12748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6296 -ip 6296
1⤵
PID:12828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3920 -ip 3920
1⤵
PID:12900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 1800 -ip 1800
1⤵
PID:12952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5824 -ip 5824
1⤵
PID:12932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2596 -ip 2596
1⤵
PID:13048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 7268 -ip 7268
1⤵
PID:13172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 6400 -ip 6400
1⤵
PID:13180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 8692 -ip 8692
1⤵
PID:13232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 7864 -ip 7864
1⤵
PID:11284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 7744 -ip 7744
1⤵
PID:11612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1948 -ip 1948
1⤵
PID:11896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 8712 -ip 8712
1⤵
PID:11888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 8696 -ip 8696
1⤵
PID:12460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4984 -ip 4984
1⤵
PID:12004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5576 -ip 5576
1⤵
PID:12908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 1436 -ip 1436
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2924 -ip 2924
1⤵
PID:11076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6260 -ip 6260
1⤵
PID:12664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6360 -ip 6360
1⤵
PID:11884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 6692 -ip 6692
1⤵
PID:12992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 6216 -ip 6216
1⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2212 -ip 2212
1⤵
PID:11792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 6564 -ip 6564
1⤵
PID:12732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 2112 -ip 2112
1⤵
PID:11724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4104 -ip 4104
1⤵
PID:11404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1956 -ip 1956
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 6868 -ip 6868
1⤵
PID:10752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 7280 -ip 7280
1⤵
PID:12184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 1020 -ip 1020
1⤵
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7236 -ip 7236
1⤵
PID:11384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 6528 -ip 6528
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5728 -ip 5728
1⤵
PID:9344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 5476 -ip 5476
1⤵
PID:13420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 6024 -ip 6024
1⤵
PID:13580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 5636 -ip 5636
1⤵
PID:13604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4232 -ip 4232
1⤵
PID:13616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4688 -ip 4688
1⤵
PID:13624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 5628 -ip 5628
1⤵
PID:13632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 5256 -ip 5256
1⤵
PID:13644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 6276 -ip 6276
1⤵
PID:13920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6252 -ip 6252
1⤵
PID:14000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 3484 -ip 3484
1⤵
PID:12244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 5820 -ip 5820
1⤵
PID:8256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 7768 -ip 7768
1⤵
PID:13348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 5632 -ip 5632
1⤵
PID:11888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6280 -ip 6280
1⤵
PID:13692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 1524 -ip 1524
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 1696 -ip 1696
1⤵
PID:13996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 1836 -ip 1836
1⤵
PID:7280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 7116 -ip 7116
1⤵
PID:14100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6860 -ip 6860
1⤵
PID:13352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5912 -ip 5912
1⤵
PID:10432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 7000 -ip 7000
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4660 -ip 4660
1⤵
PID:9740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 8548 -ip 8548
1⤵
PID:12548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 9512 -ip 9512
1⤵
PID:12392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5436 -ip 5436
1⤵
PID:10292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 9900 -ip 9900
1⤵
PID:9936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 10816 -ip 10816
1⤵
PID:10084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 10124 -ip 10124
1⤵
PID:9332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 10576 -ip 10576
1⤵
PID:8600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 10480 -ip 10480
1⤵
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 5404 -ip 5404
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6224 -ip 6224
1⤵
PID:7888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1440 -p 6404 -ip 6404
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1452 -p 10252 -ip 10252
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1480 -p 11168 -ip 11168
1⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1488 -p 3324 -ip 3324
1⤵
PID:10984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1484 -p 5236 -ip 5236
1⤵
PID:7440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1492 -p 4892 -ip 4892
1⤵
PID:10392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1504 -p 5788 -ip 5788
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1528 -p 9156 -ip 9156
1⤵
PID:8484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1552 -p 7264 -ip 7264
1⤵
PID:7368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1588 -p 5480 -ip 5480
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1628 -p 8148 -ip 8148
1⤵
PID:8616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1656 -p 2100 -ip 2100
1⤵
PID:9680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1516 -p 3124 -ip 3124
1⤵
PID:14224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1732 -p 7172 -ip 7172
1⤵
PID:11000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1696 -p 6672 -ip 6672
1⤵
PID:10976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1756 -p 7288 -ip 7288
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1804 -p 11372 -ip 11372
1⤵
PID:10932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1808 -p 14228 -ip 14228
1⤵
PID:11672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1436 -p 7736 -ip 7736
1⤵
PID:9200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1584 -p 7272 -ip 7272
1⤵
PID:9560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1424 -p 9780 -ip 9780
1⤵
PID:9072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 10988 -ip 10988
1⤵
PID:10644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 3572 -ip 3572
1⤵
PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1824 -p 8804 -ip 8804
1⤵
PID:8860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1852 -p 7676 -ip 7676
1⤵
PID:12604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1860 -p 11580 -ip 11580
1⤵
PID:12468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1472 -p 7984 -ip 7984
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe

Filesize
468KB

MD5
9fe19eb985678b6ba30513f278cc5047

SHA1
c8e042002c2b5e6e8335ab0d2cd7b5263fec146d

SHA256
b6c080d490c114ff2c833d3363a6c046969734392f15f5e7c070581080d4a17a

SHA512
1695ae126939ab394afeecd26280e978db0cc60c48b25e3321e5475601a6dcca6ed10c031889da3ea35c8c55930492810d9d43c1df7e90ac3564cdfb1c79a377

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe

Filesize
468KB

MD5
3161d97c6084c4c79f3eafbcc67f7ec6

SHA1
a4a9a29b50aaf9e8ae8d0871ec65da527af1d18c

SHA256
5ee0171ff88f7733cba0fbb14b61a5a3ed322074844b88c2f6aaf936ee17efb5

SHA512
64a11282057d82ca5e2e2f8776674af8fe56da89f7bf354dc36c55d26fd60421add04bc7c82dbdcdc035e01299d3fc712b188690c32f4e9b71f76324134971e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23516.exe

Filesize
468KB

MD5
55a8d04190aafd4df36a6baddfb676a2

SHA1
135a9e28bbeb17d361b7d9b7f24aacacb3287cd7

SHA256
98fcaffbd717fa2e681a8e49de478a3e0c70e80bc047720b2be0da7d0e7ddfb8

SHA512
00a326cc5333e327f45a67de3e7b40e01e9ff0f2712a6b8f01f43e9af66bcf95d142eecac28972be56bc74ed9064912f7483b67b43c801125e116f796c4f1f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe

Filesize
468KB

MD5
b3f43590614128a0111d1bf697179ecf

SHA1
3b1243aa9a86fb8fe5b5cccda5ab1a4f03d60853

SHA256
87aad8b3e7c82b00ba5728169bcacec5fb04a3e976ebdf0077a4980325254a52

SHA512
d8587218c880beb28e34137c138989df215a2bf19169bd1e2f00fc04c3c9e1adc20c55c7948be6f971241582ab83cf31d720b24a5b4c6a26922eb33f8622c32d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26108.exe

Filesize
468KB

MD5
9788a0eadae7e28f479e7dbf18582f1a

SHA1
5b539ff38b6c1fc429d4875abd9d23f22fdc601e

SHA256
62429cf672c328625a2f6742cbc7acff3a7046d65afb02472216e0708ee1f652

SHA512
effa0bef012f3878146d7d3ceeb74412bc2ecc4eeca6376d95f3d097e5814ce6ce7002b3c4c18124e9a1413669cbf0af650030b6ff95b04822217f5ca9eaeee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe

Filesize
468KB

MD5
f4e07d0daede6e9da377ce72763d5089

SHA1
f3cc398dad76acabf4e16710d99a1a866c5855bf

SHA256
85dc572b0b1ed3729bf4bd02bee3872b7cdc34283cf5229a33f88f866a73381d

SHA512
fba774aa1b07f17fc7d920b49ee9574158417d0dadbdf0131923b84e11386c3120ea24119506c0267e0067766e823f5a4f723dc5caaacd4653eaf67bea9e925f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29279.exe

Filesize
468KB

MD5
d9899cbf50ddb25a40988fcfe125c78c

SHA1
9712c5d7ddae9df14cd6265bd0f1a0021977e06e

SHA256
c8b2a464751e14e10ed3f7946ab6456b7301b28dfb11ccd2b13bf14d720fb21f

SHA512
8cab75fb0cfe2daea3d89956bf3ce0978e265ca886f9528a883c471c986729d2890d452b81d3849e8d2281b3b153cfc6228f696ca12bf171f6d6ec3ba2e0a5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe

Filesize
468KB

MD5
ddfbdfb257a7f5fcf106242f0ac63b0b

SHA1
0ac06bc1b3c23940786911658573fb645f121dab

SHA256
fdee95538161cfda489abcb463d77aff8095a96f6d6ac84cabed9bd5a78ec1c2

SHA512
72310725254d77607fb079f482b536607b8454f03f16f3bfb4fcb0f40ca1483ca3eab0daee7f99f3e3d6181b186c50476ded6f3b9af9ab8e6b3f5c6036cd4fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32722.exe

Filesize
468KB

MD5
fc94fcea15376fb7d4af07f941175016

SHA1
0b3f1ad677f6ee36d3e0c5cd391e17ddef465abd

SHA256
be4f29812b13607c8cb21e6e165a44ee9eb5211cd7df63eae89130c843c5507c

SHA512
0ae5f9a19bf14afd28610fb6bba0e6cd386cc9c847271f1adaa8f61fabfad38230b0e10b5053f8b3d5657976f262ca231782bea770c5f9e02c4a1882dc908836

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe

Filesize
468KB

MD5
6aa296a3b5e2383819ce92c06fdef444

SHA1
2f8209ec8acc91d049d78a135f66a2064772ec58

SHA256
51205cd2b486230182477d2c80812c8b840377f560bc0de5aa7762edd639ff2e

SHA512
c168b402ef7e9b67efb1c2a279d916d6b131abd9b80e19ebce3e7265c9e266bd2f9275f14d100a49b241a880b2d6774cf11c4692e4c2d36fbbd70fedfc90652c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36946.exe

Filesize
468KB

MD5
3947ffd9647138b32ba8ca35feffac52

SHA1
c6c1588c84f574236f7abbe3cd075dfb3bb4fea0

SHA256
e13b19ee17906abc7fe4c0299c841225db6ba51c2843cd8873cd5ec5f7c394eb

SHA512
3804af70af04abe22de2f8238abc2b089fda9bdce9c6770ac0467ad5f8b04acfc714b612aa4c59b904b669447e070cc7da277fab7bb93a83c3dc27f313b05656

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38984.exe

Filesize
468KB

MD5
1478c3dd195f608c338013a7698ce64e

SHA1
e9a8874e6c292944ba308c8eec91d353f1606e59

SHA256
b5105eb2ec0e70387fa7de3aacf80180a04027c1c4d877c1b7cd490a841471a5

SHA512
44ca55d7e3fb2336b58da85d3ae52c386a04a1884a17527380e37b0a86f06e6423d8f80c39d133d441159d54236e460d6cc298d06fee0bd8eec5e145d70c3f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39494.exe

Filesize
468KB

MD5
126894f99e14108388e60cc8a991eb6b

SHA1
40cedb3a434d322fc695bbebef25f866994f7a01

SHA256
9f1346011318e0b82140000653c4284c03bd04cd80cc5c96925f73d0bd7ff473

SHA512
b76357e067c7886d6be21cb0cea89bc98b788749593340bc59f7a222f511c36a0a054ba0d989946173e5b95fbf2b97926ffd193b6e0334e82ac2c129d6269e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40646.exe

Filesize
468KB

MD5
ff7db79a56b43dace73e9fe8f99e96e9

SHA1
0c454e4504fb49bc36b6c197416f7565dc262b64

SHA256
c01a9ef10b7b2b69d69434fcf01dfad66f5d6ce501da90f28ff3c8caac219617

SHA512
24f8847e29c41ce1c4d35956711995e976b36d4f0c61e1708303e77f383be4b59c4ee96618b484da3d5a92a92ebb45eb4dd9610e174cf57dcb9800f7c847581d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4465.exe

Filesize
468KB

MD5
fbaea8741663dbb613e3089273f64ecd

SHA1
4cba33f8d53781effb1e5dc2b95ca02b07ff0df5

SHA256
fedbb18a6a785cf64e5bcee5b39ac116ba49a8d71279f9dcb8ee3a602aac0e23

SHA512
9707fc43c8aa24514d355f3826e094b4c134261fcb645ebb5ec11c8d35707cef8e89fe6a10d8e27bda4b4697c26123b4c6bb636059925dc136fbd69baa397ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe

Filesize
468KB

MD5
acb41369fa0cae6ab51467e225e0302f

SHA1
0608028192e430bb3dbdb5ce75a4bde97bcd9e2e

SHA256
4f93bd6903d46299112bb8cc66db36b343ee00aef7aa4b2ce20f3e4205dbc3a5

SHA512
c378903dbfabb946afcb1c56d1a468e52a773124723fb3c31a53fc7f3aa96c008cba39a992531c6b519577bf8f8f4048649ba6cda51327dbe850cbc1dd4b31d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe

Filesize
468KB

MD5
c9d24fe716da10418c06237cfd4f753c

SHA1
de433252b2c7f264060f6fac81f848ff58333ca6

SHA256
c01bae81f579ed4829e1def1ee757961400020406aacd3ab3a92fd0c8f8e628e

SHA512
5f1c61ac0db81d79560a77917af8a8e866a1f7eab7f6c7e23eaacdcbb2e141c9c18c6dbb1a1a80dc3d8b8ffb3480f23e05e98016eddd4534752f63e41e7f21b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe

Filesize
468KB

MD5
209c96396214ba51c7b9d7d073cb4a18

SHA1
2dbe29232e59373cb8bcf8ad85fe43043ac39a25

SHA256
3f8a91aafcb81a33ee4c1137ecd9122989b3e63a0c8a5b573bb74d5eb1220499

SHA512
592b59cfdca504f5d4aea9b93285a45d11fe95a1333ecb4f237d5f4e6a21213f8a37bcf47db3ab2d808b9dfc34085df835e1a551186ab6e35b91feb2d7805c76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe

Filesize
468KB

MD5
6e351113676cfbc9d1a94aaf6149baad

SHA1
a737bed5ca9d8e72513f555de75844b7b1ed34c1

SHA256
f75334e096a44e35f8e93ffef84561ee8e477e2888be43994ca2e28e45a6aca4

SHA512
e223b945715e92d04354759d3f3144cd36b71038210efc8f93b05f69dbf6971d6e7d6e9d0dde129afc3277e4ad0d5199eb47dce03c79c2dc25a2282de07f732a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49992.exe

Filesize
468KB

MD5
104831b490c8265bb177050a64047c35

SHA1
d68f9178dd15653f8cf7af3fefa231575ee19532

SHA256
f3aa97e92fb4af5dd180f400018f1f6dbb8b4e357e84c8cd5f3c8c70fc7f98e6

SHA512
cc81380b2b570e751de49f33a95567e663e39d4dc6db6f10114ccada26811050eee0d096795968824421c1cf075cbc75dc636eec5812edbe94e09d99c3d5c98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe

Filesize
468KB

MD5
9c35ddfd567f8af620093c0aba589d5d

SHA1
8f3d002564b2b4a3fabd600386663d8f0918a1ed

SHA256
9606f9aa64c19174732cca6fcff785ad346b2b4912291a861d8376b0575f9b1c

SHA512
99fc2cb8b58d2ca2a1f7142f5513d8c1b7fb2efe2ff900df6af990016efe453e52febd5a74171aae29930051c6546241e64d93c145b320856b091e83b52a3eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe

Filesize
468KB

MD5
c6dc6fde27923770b1541c86cbcbc445

SHA1
4158d2bc1b19998c70fc3ff8e62eb0603641dd0b

SHA256
16edc249ed3f82eeed91326cbd468ca73b76e9c24b0016c8b0030ac25cd436d1

SHA512
e52f09424982bf5fd0a4ccbd004d8ce784ea710e97b1d6daa3c3f05d45d32cdb914d1331a6b10e882171e9c5d16f5c558ce35c4a25ec13f3769cc7f41c3a366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe

Filesize
468KB

MD5
84c2f8c7b7124d2346b8f2be8abd0932

SHA1
25151f0d91bd507c985bcc77321cdbd99c0d407c

SHA256
df1a63a3b7388f48b564d21165cac067eb447735afdc4358c757457a7faeaee1

SHA512
d7683500af473e6790f53487b47cd17c9ab881ce8b9808abb4c56a443a9061cdc21c3123c9003e8e1bde376e8169159b11f638bb612f2bb9e4c6e612e7244365

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe

Filesize
468KB

MD5
bbc445cbd086fc6451e012b5f77e4af3

SHA1
ca68ff6fa9d15197199d24c724156e6d1cdcb4e8

SHA256
f2fb5279da9583e5f796e596260b545cddbd5dadc08cc07a37bfa1d302aa81ea

SHA512
9d543a1188ac23f1ca594de56720acc200729377ae92462f836e620021f2a42d38ef30402623fb3f7d224da2a512d912640155020b6297d65567c8cff41db153

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57703.exe

Filesize
468KB

MD5
8ec99652c4cace27ae0e4dfb6ab58eb8

SHA1
8042a6b51b77afa93243699be68f76d9baa067af

SHA256
71fd692614748745fa698249e2c7c19494f5bd4be193e12c14f07054adf2a5b2

SHA512
0a3e14b5d2b396260454ef83199900c04c06085801a49649f9e6c0aea17aa4051edc01e27c525f225d8148c46acf2c563baf5a2a7859ea843dff813e487cbbd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57968.exe

Filesize
468KB

MD5
f8578595d9f3f4c7b76aaa89c3fca233

SHA1
0c0ce129df16fe014a90c6f2826424f88dddfa0b

SHA256
b1dca800521ce55b888c16622c5655bf0ff2e624f5a30ccea7d0e19c4900eafa

SHA512
789b3bb4e5eff4394c70be36071bf6e86fb89c09fcc627f71a44975e85cfe33696b2f6821d55b31286c5cdfbe022fe608abf6bd465a7042cb979a8302f028fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe

Filesize
468KB

MD5
1f03d783ee43dfde76cb95af26cbb3cb

SHA1
bb9782194899a2e5efa2c8ea124f99709f425e63

SHA256
bc73bf0a2f8498577b11f13cfd2aba10f027e3f96c0761daddd12c038745f7bd

SHA512
14f157e6cbbed381d699e99a125db5ea52298199ae588d08de1b060272ca3b500208d9b2bc901fb333a4070de00f9922adb45b12c4d6bad6978c60fa5fb52890

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59504.exe

Filesize
468KB

MD5
27e15cc1a8bc6cc3e3f20163f31759cf

SHA1
57710cc387e22245165d62943c4b03c2c9df9fa3

SHA256
ecb7635cb98db52e41d7de706946d9e5560802026bd81d5cb1e42dd5655d11c4

SHA512
e1dc34d9ea2a2a7365f1f1370f4fbac6d56ab9055c5330ae8641375df6f113c717a960146159d83ec00359a5a130d437c824e4462d83d47f49927fbfd879c7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe

Filesize
468KB

MD5
bea7c3248984317546f423786cfa3d64

SHA1
5a8c180ebdc27daf596d78ea94e57b6c5fd02dbf

SHA256
60906afb6dda466cf9b8484198e2842d1cd0038608b4921d784ae6f793f5eedb

SHA512
661f89e8a96476abb552fd1b5bcda6f427db521f070a47e648bf7242ab42269317d7d3c9cd71f3670f6828d23669bf51bd9e7fcb35d2af33f5574b5c87ccf616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65156.exe

Filesize
468KB

MD5
606fe5b0b1907122447ad33774b7237b

SHA1
df7d9f50589976a05d398172e4a9a2132a61cd94

SHA256
aaa9d5a4f393008469a6a3bffd82ff98426f33e01b71d2f05ac29d93124742b7

SHA512
dc6ff30568254f4f4c36e7fb4f38fde1bc7bd5b6677993cbc276777b25d60a95504d8e8b51d02112e8b90d43081d6942d81fa3fe8d076878c8e3b17e396e85d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7376.exe

Filesize
468KB

MD5
1b612473a9107c63b06240b745e66b99

SHA1
c680144897a701c1581514a7d98df72a87932c93

SHA256
f80b19cf97b9ca2f24c71a777a7f8e4216da0bbb8de09c5d205cbaaf04499584

SHA512
f7fb0b3f581136c250bb05edf1327a7b41f9bdaa224568503588f2039c0d30b79ae51b93561b330c850132d2e879133110264c38fc026713da413bc7e3a0039b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe

Filesize
468KB

MD5
15208b8709fc648b808b7ee5be4f7dd3

SHA1
07a1ea9ed878a93dc15f82478b1b76c9ed8891db

SHA256
a294d0bec617ef10f47cd5e0533409dd3d397133f56e30993189fe56257eb05b

SHA512
461ff0447a62506a7913b9e536803ee61f4dc1eb4da5faa65958ba52205418c88c4130cafc0c746b186c37e5cc5a703df5742a222741d672c1e4632347a6a2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8502.exe

Filesize
468KB

MD5
425d62a588439254ea4441621fecd471

SHA1
f4a308ca9b3dfae4acb782369dcbd72ef7eac358

SHA256
19cd7b3273e1a41e8f67e01ce714eb58c3ed55b407bb21c3f17301f5e20bebef

SHA512
bad0425765f92db2951a68da67f019437d1fed43657fc4f08d6653f01454f79635e1fe212701c8111d75e2a8250fcb53a5437b5bcb08e365b38e6c0b5d46b15d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe

Filesize
468KB

MD5
faa35f2e9757456c3665b8104c16c9c6

SHA1
1df05550f0c7448667a1e3359c5adc82fd19df23

SHA256
58a97f4efee293f901394e8091cab73c690fede29fb29e6b080f6f1490a5bce3

SHA512
0960ecaee7f7f63bfa30c46c6d27a40f0850cc367485396bfb3970372c9f088e371856249ebdbb8809b99fca49cf49b8ae8f34914efd199429cb8d80543f49de

Download Submit
memory/428-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/800-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-2596-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4056-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4104-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9648-2566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10288-2603-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download