fd44568ef0d52b18f9999735311c710b41fa1bf7f350b3a870d4dd021a21ad2f

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fe97c55f467fdca610ebeca263e0e50N.exe
Size

468KB
MD5

1fe97c55f467fdca610ebeca263e0e50
SHA1

fa597e78ce14887e1128d68b0c9cb08677969ae2
SHA256

fd44568ef0d52b18f9999735311c710b41fa1bf7f350b3a870d4dd021a21ad2f
SHA512

eda3d57796624e7169c7714aa97f03f7c8f0fdabd123ede0c0a40509e66788334e83cbfc0a7421563c5db18ed2185bb065abc1ce64702d6616da00fc7abfb175
SSDEEP

3072:RG3nogISIE5TtbY2HncOcf8gvChaP0p2JVHeTVPMQ7NL6KvgEElb:RGXobMTtxHcOcftYHKQ7pBvgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4032	Unicorn-662.exe
1896	Unicorn-33927.exe
464	Unicorn-14746.exe
1008	Unicorn-53940.exe
3740	Unicorn-49534.exe
3592	Unicorn-63269.exe
4752	Unicorn-35876.exe
3336	Unicorn-34158.exe
2592	Unicorn-14557.exe
2228	Unicorn-28292.exe
1088	Unicorn-55108.exe
1400	Unicorn-23287.exe
2356	Unicorn-3421.exe
2768	Unicorn-15041.exe
3488	Unicorn-17841.exe
1836	Unicorn-23707.exe
1896	Unicorn-23972.exe
1600	Unicorn-21767.exe
4524	Unicorn-2586.exe
1152	Unicorn-9955.exe
3720	Unicorn-9955.exe
3052	Unicorn-42436.exe
4088	Unicorn-5658.exe
3716	Unicorn-34852.exe
3876	Unicorn-2945.exe
3736	Unicorn-11875.exe
2396	Unicorn-43671.exe
4360	Unicorn-57355.exe
656	Unicorn-11418.exe
3532	Unicorn-51755.exe
3780	Unicorn-21300.exe
2216	Unicorn-21300.exe
1192	Unicorn-16893.exe
1732	Unicorn-64178.exe
4220	Unicorn-13318.exe
4740	Unicorn-45451.exe
3644	Unicorn-64548.exe
4636	Unicorn-63972.exe
4828	Unicorn-37255.exe
3112	Unicorn-53399.exe
3740	Unicorn-54084.exe
1960	Unicorn-1162.exe
4952	Unicorn-21028.exe
2616	Unicorn-36487.exe
844	Unicorn-61444.exe
4024	Unicorn-49979.exe
3756	Unicorn-27172.exe
4824	Unicorn-35838.exe
2636	Unicorn-11322.exe
1856	Unicorn-16922.exe
2436	Unicorn-30657.exe
4904	Unicorn-32381.exe
5348	Unicorn-26404.exe
5380	Unicorn-41863.exe
5372	Unicorn-41863.exe
5400	Unicorn-57742.exe
5424	Unicorn-6154.exe
5432	Unicorn-6154.exe
5452	Unicorn-3553.exe
5652	Unicorn-30343.exe
5668	Unicorn-26621.exe
5696	Unicorn-467.exe
5712	Unicorn-10481.exe
5804	Unicorn-31495.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3532	1896	WerFault.exe	100
2404	1896	WerFault.exe	100
4396	3740	WerFault.exe	105
1152	3592	WerFault.exe	106
1964	3740	WerFault.exe	105
3088	3592	WerFault.exe	106
3932	2592	WerFault.exe	116
1140	2592	WerFault.exe	116
4816	1896	WerFault.exe	132
2592	1896	WerFault.exe	132
2996	2396	WerFault.exe	145
3484	4088	WerFault.exe	141
5304	3336	WerFault.exe	117
5312	3716	WerFault.exe	142
5616	1192	WerFault.exe	155
6076	3336	WerFault.exe	117
5980	4088	WerFault.exe	141
1976	3716	WerFault.exe	142
1696	1192	WerFault.exe	155
6036	1856	WerFault.exe	175
6172	4824	WerFault.exe	173
6732	4904	WerFault.exe	177
6692	5380	WerFault.exe	185
6644	4636	WerFault.exe	160
7048	1856	WerFault.exe	175
7156	4024	WerFault.exe	171
4588	6032	WerFault.exe	232
8060	4792	WerFault.exe	246
5920	5584	WerFault.exe	222
7736	6084	WerFault.exe	297
6808	396	WerFault.exe	325
7836	5864	WerFault.exe	251
8960	2452	WerFault.exe	362
9124	4088	WerFault.exe	244
8860	3484	WerFault.exe	178
8540	64	WerFault.exe
8332	5340	WerFault.exe	248
6928	5320	WerFault.exe	250
9028	6816	WerFault.exe	339
8628	5560	WerFault.exe
8924	6280	WerFault.exe	329
8168	7124	WerFault.exe	320
8092	7908	WerFault.exe	397
7804	5188	WerFault.exe	300
5012	6444	WerFault.exe	271
9884	6024	WerFault.exe	206
9836	6708	WerFault.exe	282
10104	6660	WerFault.exe	280
10096	6460	WerFault.exe	272
10088	3532	WerFault.exe	148
10080	6792	WerFault.exe	286
10072	5396	WerFault.exe	219
10064	6504	WerFault.exe	275
10056	1400	WerFault.exe	127
10048	6468	WerFault.exe	273
10040	5652	WerFault.exe	193
10032	6340	WerFault.exe	269
10024	5712	WerFault.exe	196
10016	1732	WerFault.exe	156
10008	4360	WerFault.exe	146
10000	6272	WerFault.exe	265
9992	3736	WerFault.exe	144
9968	3936	WerFault.exe	241
9560	6232	WerFault.exe	263

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1fe97c55f467fdca610ebeca263e0e50N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13309.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61444.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4844	1fe97c55f467fdca610ebeca263e0e50N.exe
4032	Unicorn-662.exe
464	Unicorn-14746.exe
1896	Unicorn-33927.exe
1008	Unicorn-53940.exe
3592	Unicorn-63269.exe
3740	Unicorn-49534.exe
4752	Unicorn-35876.exe
3336	Unicorn-34158.exe
2592	Unicorn-14557.exe
2228	Unicorn-28292.exe
1088	Unicorn-55108.exe
2356	Unicorn-3421.exe
1400	Unicorn-23287.exe
1836	Unicorn-23707.exe
1896	Unicorn-23972.exe
3488	Unicorn-17841.exe
2768	Unicorn-15041.exe
1600	Unicorn-21767.exe
4524	Unicorn-2586.exe
3720	Unicorn-9955.exe
1152	Unicorn-9955.exe
4088	Unicorn-5658.exe
3052	Unicorn-42436.exe
3716	Unicorn-34852.exe
3532	Unicorn-51755.exe
3876	Unicorn-2945.exe
3736	Unicorn-11875.exe
2396	Unicorn-43671.exe
656	Unicorn-11418.exe
4360	Unicorn-57355.exe
3780	Unicorn-21300.exe
2216	Unicorn-21300.exe
1192	Unicorn-16893.exe
1732	Unicorn-64178.exe
4220	Unicorn-13318.exe
4740	Unicorn-45451.exe
3644	Unicorn-64548.exe
4636	Unicorn-63972.exe
4828	Unicorn-37255.exe
3112	Unicorn-53399.exe
1960	Unicorn-1162.exe
4952	Unicorn-21028.exe
2616	Unicorn-36487.exe
844	Unicorn-61444.exe
3740	Unicorn-54084.exe
1856	Unicorn-16922.exe
4024	Unicorn-49979.exe
4824	Unicorn-35838.exe
2436	Unicorn-30657.exe
2636	Unicorn-11322.exe
4904	Unicorn-32381.exe
3756	Unicorn-27172.exe
5348	Unicorn-26404.exe
5424	Unicorn-6154.exe
5380	Unicorn-41863.exe
5372	Unicorn-41863.exe
5452	Unicorn-3553.exe
5400	Unicorn-57742.exe
5432	Unicorn-6154.exe
5696	Unicorn-467.exe
5652	Unicorn-30343.exe
5668	Unicorn-26621.exe
5712	Unicorn-10481.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4032	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	96
PID 4844 wrote to memory of 4032	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	96
PID 4844 wrote to memory of 4032	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	96
PID 4032 wrote to memory of 1896	4032	Unicorn-662.exe	100
PID 4032 wrote to memory of 1896	4032	Unicorn-662.exe	100
PID 4032 wrote to memory of 1896	4032	Unicorn-662.exe	100
PID 4844 wrote to memory of 464	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	101
PID 4844 wrote to memory of 464	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	101
PID 4844 wrote to memory of 464	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	101
PID 464 wrote to memory of 1008	464	Unicorn-14746.exe	104
PID 464 wrote to memory of 1008	464	Unicorn-14746.exe	104
PID 464 wrote to memory of 1008	464	Unicorn-14746.exe	104
PID 4032 wrote to memory of 3740	4032	Unicorn-662.exe	105
PID 4032 wrote to memory of 3740	4032	Unicorn-662.exe	105
PID 4032 wrote to memory of 3740	4032	Unicorn-662.exe	105
PID 4844 wrote to memory of 3592	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	106
PID 4844 wrote to memory of 3592	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	106
PID 4844 wrote to memory of 3592	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	106
PID 1008 wrote to memory of 4752	1008	Unicorn-53940.exe	114
PID 1008 wrote to memory of 4752	1008	Unicorn-53940.exe	114
PID 1008 wrote to memory of 4752	1008	Unicorn-53940.exe	114
PID 4844 wrote to memory of 3336	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	117
PID 4844 wrote to memory of 3336	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	117
PID 4844 wrote to memory of 3336	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	117
PID 464 wrote to memory of 2592	464	Unicorn-14746.exe	116
PID 464 wrote to memory of 2592	464	Unicorn-14746.exe	116
PID 464 wrote to memory of 2592	464	Unicorn-14746.exe	116
PID 4032 wrote to memory of 2228	4032	Unicorn-662.exe	118
PID 4032 wrote to memory of 2228	4032	Unicorn-662.exe	118
PID 4032 wrote to memory of 2228	4032	Unicorn-662.exe	118
PID 4752 wrote to memory of 1088	4752	Unicorn-35876.exe	125
PID 4752 wrote to memory of 1088	4752	Unicorn-35876.exe	125
PID 4752 wrote to memory of 1088	4752	Unicorn-35876.exe	125
PID 1008 wrote to memory of 2356	1008	Unicorn-53940.exe	126
PID 1008 wrote to memory of 2356	1008	Unicorn-53940.exe	126
PID 1008 wrote to memory of 2356	1008	Unicorn-53940.exe	126
PID 3336 wrote to memory of 1400	3336	Unicorn-34158.exe	127
PID 3336 wrote to memory of 1400	3336	Unicorn-34158.exe	127
PID 3336 wrote to memory of 1400	3336	Unicorn-34158.exe	127
PID 4844 wrote to memory of 2768	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	130
PID 4844 wrote to memory of 2768	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	130
PID 4844 wrote to memory of 2768	4844	1fe97c55f467fdca610ebeca263e0e50N.exe	130
PID 464 wrote to memory of 3488	464	Unicorn-14746.exe	129
PID 464 wrote to memory of 3488	464	Unicorn-14746.exe	129
PID 464 wrote to memory of 3488	464	Unicorn-14746.exe	129
PID 4032 wrote to memory of 1836	4032	Unicorn-662.exe	131
PID 4032 wrote to memory of 1836	4032	Unicorn-662.exe	131
PID 4032 wrote to memory of 1836	4032	Unicorn-662.exe	131
PID 2228 wrote to memory of 1896	2228	Unicorn-28292.exe	132
PID 2228 wrote to memory of 1896	2228	Unicorn-28292.exe	132
PID 2228 wrote to memory of 1896	2228	Unicorn-28292.exe	132
PID 1088 wrote to memory of 1600	1088	Unicorn-55108.exe	136
PID 1088 wrote to memory of 1600	1088	Unicorn-55108.exe	136
PID 1088 wrote to memory of 1600	1088	Unicorn-55108.exe	136
PID 4752 wrote to memory of 4524	4752	Unicorn-35876.exe	137
PID 4752 wrote to memory of 4524	4752	Unicorn-35876.exe	137
PID 4752 wrote to memory of 4524	4752	Unicorn-35876.exe	137
PID 1400 wrote to memory of 1152	1400	Unicorn-23287.exe	139
PID 1400 wrote to memory of 1152	1400	Unicorn-23287.exe	139
PID 1400 wrote to memory of 1152	1400	Unicorn-23287.exe	139
PID 2356 wrote to memory of 3720	2356	Unicorn-3421.exe	138
PID 2356 wrote to memory of 3720	2356	Unicorn-3421.exe	138
PID 2356 wrote to memory of 3720	2356	Unicorn-3421.exe	138
PID 1836 wrote to memory of 3052	1836	Unicorn-23707.exe	140

C:\Users\Admin\AppData\Local\Temp\1fe97c55f467fdca610ebeca263e0e50N.exe
"C:\Users\Admin\AppData\Local\Temp\1fe97c55f467fdca610ebeca263e0e50N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 720
      4⤵
      Program crash
      PID:3532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 720
      4⤵
      Program crash
      PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 632
      4⤵
      Program crash
      PID:4396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 632
      4⤵
      Program crash
      PID:1964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 724
        5⤵
        Program crash
        
        PID:4816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 724
        5⤵
        Program crash
        
        PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        9⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16884.exe
        10⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 660
        9⤵
        
        PID:16160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 664
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        8⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 728
        8⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 752
        7⤵
        Program crash
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35210.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        6⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54149.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21964.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52706.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64542.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        7⤵
        
        PID:14900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 672
        6⤵
        
        PID:7692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 748
        5⤵
        Program crash
        
        PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30657.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26036.exe
        5⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        5⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56324.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        8⤵
        
        PID:15892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 668
        7⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8376 -s 616
        7⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44901.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48606.exe
        6⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42615.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13658.exe
        7⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        6⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61844.exe
        7⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24765.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        5⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4054.exe
        6⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        7⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        5⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65207.exe
        6⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        5⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6165.exe
        5⤵
        
        PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45755.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52772.exe
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
        5⤵
        
        PID:10156
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10156 -s 628
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28606.exe
        5⤵
        
        PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
        6⤵
        
        PID:11800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 656
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2090.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
      4⤵
      PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48649.exe
      4⤵
      PID:11364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46420.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        7⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 636
        8⤵
        Program crash
        
        PID:5012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 652
        7⤵
        Program crash
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65285.exe
        6⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 636
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        6⤵
        
        PID:8780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 720
        6⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6979.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38887.exe
        8⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 632
        9⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9460.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62558.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        6⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 720
        7⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        6⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8693.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59294.exe
        7⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
        6⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43819.exe
        5⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        6⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27988.exe
        5⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        6⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53115.exe
        5⤵
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32381.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 676
        5⤵
        Program crash
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29521.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54500.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27940.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63335.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27085.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47344.exe
        8⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 712
        7⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        6⤵
        
        PID:11716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 756
        5⤵
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
      4⤵
      PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18817.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
      4⤵
      PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        5⤵
        
        PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
      4⤵
      PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21028.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4067.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43300.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 636
        9⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 636
        9⤵
        
        PID:15524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7220 -s 668
        8⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6272 -s 656
        7⤵
        Program crash
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe
        7⤵
        
        PID:864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 660
        7⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 660
        7⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3594.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        6⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22397.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8598.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        8⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9824 -s 636
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        9⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        8⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 648
        7⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        6⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
        7⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12778.exe
        6⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42340.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22199.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58398.exe
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2563.exe
        7⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        6⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49063.exe
        7⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56949.exe
        6⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        5⤵
        
        PID:8512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8512 -s 632
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2442.exe
        5⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42711.exe
        6⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23116.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42059.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        5⤵
        
        PID:440
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 640
        6⤵
        
        PID:4452
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 736
        5⤵
        
        PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18417.exe
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56987.exe
      4⤵
      PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2134.exe
        5⤵
        
        PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10470.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      4⤵
      PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11322.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 644
        6⤵
        Program crash
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59877.exe
        5⤵
        
        PID:9724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9724 -s 640
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        5⤵
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18301.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38343.exe
        6⤵
        
        PID:10688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 668
        6⤵
        
        PID:16168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 660
        5⤵
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
      4⤵
      PID:8836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 660
      4⤵
      PID:11632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28103.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41484.exe
    3⤵
    PID:4824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 636
      4⤵
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
    3⤵
    PID:8700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8700 -s 636
      4⤵
      PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19965.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19965.exe
    3⤵
    PID:9704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9704 -s 636
      4⤵
      PID:9420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25923.exe
    3⤵
    PID:1968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 628
        9⤵
        Program crash
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        9⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 728
        10⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        9⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 632
        10⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10785.exe
        9⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        10⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        10⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        10⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49250.exe
        8⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 636
        9⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        8⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 640
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4614.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 636
        10⤵
        Program crash
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        9⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 680
        9⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6816 -s 640
        9⤵
        Program crash
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22193.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        9⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5348.exe
        8⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 632
        7⤵
        Program crash
        
        PID:5616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 672
        7⤵
        Program crash
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3553.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28423.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        9⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        10⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        11⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        10⤵
        
        PID:15408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 652
        9⤵
        
        PID:15724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 616
        8⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 664
        7⤵
        Program crash
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32225.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17165.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        6⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        9⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 676
        9⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11894.exe
        7⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 636
        8⤵
        Program crash
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17985.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65076.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43383.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        9⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28154.exe
        9⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62478.exe
        8⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35383.exe
        9⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 632
        8⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48510.exe
        7⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 532
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37205.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        8⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 640
        7⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
        6⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 644
        7⤵
        Program crash
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29050.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38551.exe
        6⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61012.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19930.exe
        7⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55989.exe
        7⤵
        
        PID:14140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 716
        6⤵
        Program crash
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2294.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        6⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 636
        7⤵
        
        PID:6620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 740
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33370.exe
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19347.exe
        5⤵
        
        PID:8356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 744
        5⤵
        
        PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13318.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3939.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14147.exe
        9⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46564.exe
        10⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        11⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44622.exe
        11⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        10⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        11⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        12⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        10⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        11⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14013.exe
        10⤵
        
        PID:14596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 720
        9⤵
        Program crash
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        8⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 640
        9⤵
        Program crash
        
        PID:7804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 648
        8⤵
        Program crash
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        8⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        9⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
        10⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        10⤵
        
        PID:14356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 652
        9⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 628
        8⤵
        Program crash
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        8⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47143.exe
        9⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        8⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36119.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46052.exe
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        9⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        10⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9052 -s 632
        11⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-525.exe
        10⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        11⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
        10⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10570.exe
        9⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        9⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        9⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 640
        8⤵
        Program crash
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22058.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7976 -s 636
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20465.exe
        7⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 744
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16833.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33015.exe
        7⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60635.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62587.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        8⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        6⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34999.exe
        7⤵
        
        PID:9532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 716
        6⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:64
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 636
        7⤵
        Program crash
        
        PID:8540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 740
        6⤵
        Program crash
        
        PID:10024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 740
        6⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60654.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15684.exe
        6⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 636
        7⤵
        
        PID:1360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 636
        6⤵
        Program crash
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29729.exe
        5⤵
        
        PID:6500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 636
        6⤵
        
        PID:9168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 700
        6⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2941.exe
        5⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        6⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58967.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 724
        5⤵
        Program crash
        
        PID:5312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 724
        5⤵
        Program crash
        
        PID:1976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 628
        5⤵
        Program crash
        
        PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      4⤵
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59444.exe
        6⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 632
        7⤵
        
        PID:14400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 660
        6⤵
        
        PID:10224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 628
        5⤵
        Program crash
        
        PID:9968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 628
        5⤵
        
        PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15773.exe
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        5⤵
        
        PID:4148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 668
        5⤵
        
        PID:8908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7812 -s 668
        5⤵
        
        PID:3932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
      4⤵
      PID:8572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 644
      4⤵
      Program crash
      PID:3932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 644
      4⤵
      Program crash
      PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60551.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        9⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        10⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12342.exe
        11⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33782.exe
        12⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54365.exe
        11⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
        10⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        11⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52277.exe
        10⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 744
        9⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 744
        9⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14794.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2842.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43767.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14134.exe
        9⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
        10⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10941.exe
        9⤵
        
        PID:13676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 668
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48582.exe
        8⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        8⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 636
        9⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 668
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24218.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        8⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62114.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35451.exe
        7⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        6⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50695.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14108.exe
        7⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        8⤵
        
        PID:7380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 724
        6⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
        8⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 636
        9⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34957.exe
        8⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 636
        7⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 636
        7⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        6⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10312 -s 636
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31211.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
        6⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        5⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48260.exe
        7⤵
        
        PID:11856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 636
        6⤵
        
        PID:11688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 644
        5⤵
        Program crash
        
        PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30359.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        7⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 636
        8⤵
        Program crash
        
        PID:8628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 656
        7⤵
        Program crash
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        6⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 636
        7⤵
        
        PID:8980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 716
        6⤵
        
        PID:7156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 720
        5⤵
        Program crash
        
        PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29140.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        6⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 632
        7⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        6⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 652
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        6⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11396 -s 540
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17684.exe
        6⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63271.exe
        7⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57630.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        6⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 636
        5⤵
        
        PID:13852
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 636
        5⤵
        
        PID:15420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37255.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6051.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47012.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12822.exe
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61262.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        10⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41618.exe
        9⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        8⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9664 -s 640
        9⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65110.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
        8⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 712
        7⤵
        Program crash
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16765.exe
        6⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 636
        7⤵
        Program crash
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37954.exe
        6⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29117.exe
        7⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4113.exe
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        6⤵
        
        PID:1020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 652
        6⤵
        Program crash
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12436.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-835.exe
        6⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
        6⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13686.exe
        7⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23124.exe
        6⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        5⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32438.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        5⤵
        
        PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        5⤵
        
        PID:2904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 636
        6⤵
        
        PID:3324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6024 -s 664
        5⤵
        Program crash
        
        PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
      4⤵
      PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
      4⤵
      PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18663.exe
        6⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3638.exe
        7⤵
        
        PID:16252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 636
        5⤵
        
        PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22109.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
      4⤵
      PID:13680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49108.exe
        5⤵
        
        PID:6848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 712
        5⤵
        Program crash
        
        PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23098.exe
      4⤵
      PID:6084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 676
        5⤵
        Program crash
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        5⤵
        
        PID:6720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 648
        5⤵
        
        PID:1264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 648
        5⤵
        
        PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10186.exe
      4⤵
      PID:8680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 488
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59397.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
      4⤵
      PID:13704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
    3⤵
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30279.exe
        6⤵
        
        PID:10320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 648
        5⤵
        
        PID:8432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 756
      4⤵
      Program crash
      PID:9124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6515.exe
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
        5⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63079.exe
        6⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
        5⤵
        
        PID:13824
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 668
      4⤵
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    3⤵
    PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20884.exe
      4⤵
      PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
        5⤵
        
        PID:8240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32101.exe
    3⤵
    PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
      4⤵
      PID:15760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
    3⤵
    PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21877.exe
    3⤵
    PID:15960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 636
    3⤵
    - Program crash
    PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 636
    3⤵
    - Program crash
    PID:3088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23287.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8054.exe
        5⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        6⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7908 -s 720
        7⤵
        Program crash
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21617.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        6⤵
        
        PID:9808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 716
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25428.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        8⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9548 -s 640
        9⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16218.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        7⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9708 -s 548
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39186.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41485.exe
        7⤵
        
        PID:9148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6504 -s 636
        6⤵
        Program crash
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        5⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19732.exe
        6⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48774.exe
        7⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43501.exe
        5⤵
        
        PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37902.exe
      4⤵
      PID:6932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 512
      4⤵
      Program crash
      PID:10056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 724
      4⤵
      Program crash
      PID:3484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 756
      4⤵
      Program crash
      PID:5980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 744
    3⤵
    - Program crash
    PID:5304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 744
    3⤵
    - Program crash
    PID:6076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 720
      4⤵
      Program crash
      PID:2996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16922.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 724
      4⤵
      Program crash
      PID:6036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 744
      4⤵
      Program crash
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30372.exe
    3⤵
    PID:4792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 676
      4⤵
      Program crash
      PID:8060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6682.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
      4⤵
      PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        5⤵
        
        PID:12276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 644
      4⤵
      PID:13884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
    3⤵
    PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3203.exe
      4⤵
      PID:10456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61723.exe
    3⤵
    PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
    3⤵
    PID:15180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63972.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
        5⤵
        
        PID:5216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 672
        6⤵
        
        PID:6492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 788
      4⤵
      Program crash
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
    3⤵
    PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5475.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34650.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48390.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6913.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
        8⤵
        
        PID:1328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 724
        6⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        5⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49983.exe
        7⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11036.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62814.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        5⤵
        
        PID:8188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
      4⤵
      PID:6312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 628
      4⤵
      Program crash
      PID:10096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
    3⤵
    PID:7900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 752
    3⤵
    - Program crash
    PID:10088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61444.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
    3⤵
    PID:5692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
  2⤵
  PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 636
      4⤵
      Program crash
      PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
    3⤵
    PID:7896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 636
      4⤵
      PID:13876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
    3⤵
    PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28140.exe
      4⤵
      PID:13460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
    3⤵
    PID:10108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
    3⤵
    PID:15476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
  2⤵
  PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
      4⤵
      PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31478.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
      4⤵
      PID:15300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46142.exe
    3⤵
    PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31476.exe
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
      4⤵
      PID:4280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
    3⤵
    PID:13928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47165.exe
    3⤵
    PID:7808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
  2⤵
  PID:8944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
  2⤵
  PID:12164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35486.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35486.exe
  2⤵
  PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1896 -ip 1896
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1896 -ip 1896
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3740 -ip 3740
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3592 -ip 3592
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3740 -ip 3740
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3592 -ip 3592
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2592 -ip 2592
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2592 -ip 2592
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1896 -ip 1896
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1896 -ip 1896
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2396 -ip 2396
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4088 -ip 4088
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3716 -ip 3716
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3336 -ip 3336
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1192 -ip 1192
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2396 -ip 2396
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4088 -ip 4088
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3336 -ip 3336
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3716 -ip 3716
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1192 -ip 1192
1⤵
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1856 -ip 1856
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4824 -ip 4824
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4904 -ip 4904
1⤵
PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5380 -ip 5380
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4824 -ip 4824
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4904 -ip 4904
1⤵
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1600 -ip 1600
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5380 -ip 5380
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5696 -ip 5696
1⤵
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5820 -ip 5820
1⤵
PID:6444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5804 -ip 5804
1⤵
PID:6608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3780 -ip 3780
1⤵
PID:6828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4740 -ip 4740
1⤵
PID:6944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4636 -ip 4636
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3644 -ip 3644
1⤵
PID:7108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1152 -ip 1152
1⤵
PID:7128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1600 -ip 1600
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5648 -ip 5648
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2996 -ip 2996
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5696 -ip 5696
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5804 -ip 5804
1⤵
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5820 -ip 5820
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4740 -ip 4740
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3780 -ip 3780
1⤵
PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4024 -ip 4024
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3644 -ip 3644
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4636 -ip 4636
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5348 -ip 5348
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 1152 -ip 1152
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5648 -ip 5648
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2996 -ip 2996
1⤵
PID:6972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4024 -ip 4024
1⤵
PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1856 -ip 1856
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5348 -ip 5348
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6032 -ip 6032
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5520 -ip 5520
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3360 -ip 3360
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5632 -ip 5632
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4792 -ip 4792
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4948 -ip 4948
1⤵
PID:6836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5692 -ip 5692
1⤵
PID:6428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3448 -ip 3448
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5520 -ip 5520
1⤵
PID:6364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3360 -ip 3360
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4500 -ip 4500
1⤵
PID:5636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5632 -ip 5632
1⤵
PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4116 -ip 4116
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4792 -ip 4792
1⤵
PID:7256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5756 -ip 5756
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 6720 -ip 6720
1⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4948 -ip 4948
1⤵
PID:7468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5692 -ip 5692
1⤵
PID:7676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5504 -ip 5504
1⤵
PID:7792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6848 -ip 6848
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6288 -ip 6288
1⤵
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3448 -ip 3448
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 844 -ip 844
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6084 -ip 6084
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3488 -ip 3488
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5876 -ip 5876
1⤵
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5452 -ip 5452
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5432 -ip 5432
1⤵
PID:7984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6512 -ip 6512
1⤵
PID:7560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6332 -ip 6332
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6380 -ip 6380
1⤵
PID:7864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5216 -ip 5216
1⤵
PID:7744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6620 -ip 6620
1⤵
PID:7804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5372 -ip 5372
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 6240 -ip 6240
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4500 -ip 4500
1⤵
PID:7856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4116 -ip 4116
1⤵
PID:7464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5584 -ip 5584
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5756 -ip 5756
1⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6720 -ip 6720
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5272 -ip 5272
1⤵
PID:8180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5504 -ip 5504
1⤵
PID:7800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5852 -ip 5852
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6108 -ip 6108
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4952 -ip 4952
1⤵
PID:7688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6848 -ip 6848
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6288 -ip 6288
1⤵
PID:7068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 844 -ip 844
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 6084 -ip 6084
1⤵
PID:7092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5452 -ip 5452
1⤵
PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5876 -ip 5876
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3488 -ip 3488
1⤵
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5432 -ip 5432
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6512 -ip 6512
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6332 -ip 6332
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 6380 -ip 6380
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5216 -ip 5216
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6620 -ip 6620
1⤵
PID:8024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5372 -ip 5372
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6240 -ip 6240
1⤵
PID:8092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5272 -ip 5272
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7832 -ip 7832
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5852 -ip 5852
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6108 -ip 6108
1⤵
PID:8016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4952 -ip 4952
1⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4492 -ip 4492
1⤵
PID:8448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 7148 -ip 7148
1⤵
PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 5440 -ip 5440
1⤵
PID:8180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 396 -ip 396
1⤵
PID:8964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 7136 -ip 7136
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6312 -ip 6312
1⤵
PID:8628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1020 -ip 1020
1⤵
PID:8828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 7344 -ip 7344
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 7724 -ip 7724
1⤵
PID:8924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 7900 -ip 7900
1⤵
PID:9092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6448 -ip 6448
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 6932 -ip 6932
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5464 -ip 5464
1⤵
PID:9020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2452 -ip 2452
1⤵
PID:8540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7908 -ip 7908
1⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 4088 -ip 4088
1⤵
PID:8844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 64 -ip 64
1⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5188 -ip 5188
1⤵
PID:8876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4824 -ip 4824
1⤵
PID:8992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6444 -ip 6444
1⤵
PID:7692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 7976 -ip 7976
1⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5240 -ip 5240
1⤵
PID:9312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5992 -ip 5992
1⤵
PID:9400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6844 -ip 6844
1⤵
PID:9440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 2556 -ip 2556
1⤵
PID:9484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2904 -ip 2904
1⤵
PID:9524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6800 -ip 6800
1⤵
PID:9592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6500 -ip 6500
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6732 -ip 6732
1⤵
PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4984 -ip 4984
1⤵
PID:9692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 7124 -ip 7124
1⤵
PID:9720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6280 -ip 6280
1⤵
PID:9916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5560 -ip 5560
1⤵
PID:10124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6032 -ip 6032
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6816 -ip 6816
1⤵
PID:9676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5864 -ip 5864
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5320 -ip 5320
1⤵
PID:10248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5340 -ip 5340
1⤵
PID:10336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3484 -ip 3484
1⤵
PID:10412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6232 -ip 6232
1⤵
PID:10416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3936 -ip 3936
1⤵
PID:10640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6708 -ip 6708
1⤵
PID:10992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6660 -ip 6660
1⤵
PID:11224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6460 -ip 6460
1⤵
PID:9984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3532 -ip 3532
1⤵
PID:10964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6792 -ip 6792
1⤵
PID:11088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5396 -ip 5396
1⤵
PID:10456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6504 -ip 6504
1⤵
PID:10496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1400 -ip 1400
1⤵
PID:10840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6468 -ip 6468
1⤵
PID:9960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5652 -ip 5652
1⤵
PID:10520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6340 -ip 6340
1⤵
PID:10444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5712 -ip 5712
1⤵
PID:11272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 1732 -ip 1732
1⤵
PID:11280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 4360 -ip 4360
1⤵
PID:11380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 6272 -ip 6272
1⤵
PID:11420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 3736 -ip 3736
1⤵
PID:11440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6024 -ip 6024
1⤵
PID:11552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 5416 -ip 5416
1⤵
PID:11604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5400 -ip 5400
1⤵
PID:11612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5360 -ip 5360
1⤵
PID:11632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4220 -ip 4220
1⤵
PID:11664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4492 -ip 4492
1⤵
PID:11920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 7216 -ip 7216
1⤵
PID:12036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 7148 -ip 7148
1⤵
PID:12044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5440 -ip 5440
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 7136 -ip 7136
1⤵
PID:9504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 7344 -ip 7344
1⤵
PID:9432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 1020 -ip 1020
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 3644 -ip 3644
1⤵
PID:13208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1212 -p 6312 -ip 6312
1⤵
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 7724 -ip 7724
1⤵
PID:9296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6652 -ip 6652
1⤵
PID:11560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1284 -p 7900 -ip 7900
1⤵
PID:12044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 6932 -ip 6932
1⤵
PID:13120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 6448 -ip 6448
1⤵
PID:9088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5464 -ip 5464
1⤵
PID:11536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 2296 -ip 2296
1⤵
PID:13512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1264 -p 3624 -ip 3624
1⤵
PID:13520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 7812 -ip 7812
1⤵
PID:13528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 7220 -ip 7220
1⤵
PID:13676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6668 -ip 6668
1⤵
PID:13744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 4816 -ip 4816
1⤵
PID:13752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 7444 -ip 7444
1⤵
PID:14136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 7712 -ip 7712
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 6188 -ip 6188
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2400 -ip 2400
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6964 -ip 6964
1⤵
PID:12524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 3716 -ip 3716
1⤵
PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1300 -p 5964 -ip 5964
1⤵
PID:13584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 5824 -ip 5824
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 7820 -ip 7820
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6456 -ip 6456
1⤵
PID:14008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 7028 -ip 7028
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 7244 -ip 7244
1⤵
PID:11480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 6324 -ip 6324
1⤵
PID:14376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5868 -ip 5868
1⤵
PID:14516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 440 -ip 440
1⤵
PID:14968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 8124 -ip 8124
1⤵
PID:15080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4044 -ip 4044
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 5780 -ip 5780
1⤵
PID:13516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6176 -ip 6176
1⤵
PID:14004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 4116 -ip 4116
1⤵
PID:14880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 7896 -ip 7896
1⤵
PID:11592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 5328 -ip 5328
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6924 -ip 6924
1⤵
PID:15340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 2636 -ip 2636
1⤵
PID:15472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 2616 -ip 2616
1⤵
PID:15480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5668 -ip 5668
1⤵
PID:15488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4752 -ip 4752
1⤵
PID:15496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2216 -ip 2216
1⤵
PID:15504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 8680 -ip 8680
1⤵
PID:15948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 5584 -ip 5584
1⤵
PID:15956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 6844 -ip 6844
1⤵
PID:14880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5864 -ip 5864
1⤵
PID:15292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7360 -ip 7360
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 8684 -ip 8684
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 7240 -ip 7240
1⤵
PID:15572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8336 -ip 8336
1⤵
PID:8888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 5904 -ip 5904
1⤵
PID:15964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 8744 -ip 8744
1⤵
PID:15988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1376 -p 8944 -ip 8944
1⤵
PID:9472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 6924 -ip 6924
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 7908 -ip 7908
1⤵
PID:16000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 6280 -ip 6280
1⤵
PID:10232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2556 -ip 2556
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 2904 -ip 2904
1⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3936 -ip 3936
1⤵
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 4824 -ip 4824
1⤵
PID:11092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 5992 -ip 5992
1⤵
PID:8284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 6816 -ip 6816
1⤵
PID:10032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 4984 -ip 4984
1⤵
PID:8960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1496 -p 5320 -ip 5320
1⤵
PID:8844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 6708 -ip 6708
1⤵
PID:15840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 5188 -ip 5188
1⤵
PID:15864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 7548 -ip 7548
1⤵
PID:15888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6432 -ip 6432
1⤵
PID:15896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 4752 -ip 4752
1⤵
PID:15920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5436 -ip 5436
1⤵
PID:15472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6532 -ip 6532
1⤵
PID:15660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1488 -p 8184 -ip 8184
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 8820 -ip 8820
1⤵
PID:9152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1512 -p 5996 -ip 5996
1⤵
PID:9068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 5768 -ip 5768
1⤵
PID:15488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 8424 -ip 8424
1⤵
PID:14916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1536 -p 10548 -ip 10548
1⤵
PID:15528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 12140 -ip 12140
1⤵
PID:16060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1512 -p 12212 -ip 12212
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 7220 -ip 7220
1⤵
PID:16340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 11396 -ip 11396
1⤵
PID:15960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1468 -p 6604 -ip 6604
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1500 -p 8564 -ip 8564
1⤵
PID:16316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9808 -ip 9808
1⤵
PID:16300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1312 -p 10816 -ip 10816
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1088 -ip 1088
1⤵
PID:16372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6832 -ip 6832
1⤵
PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1464 -p 6700 -ip 6700
1⤵
PID:15480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 9704 -ip 9704
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 8292 -ip 8292
1⤵
PID:9492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1476 -p 7772 -ip 7772
1⤵
PID:15608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 10464 -ip 10464
1⤵
PID:6908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1524 -p 9872 -ip 9872
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8768 -ip 8768
1⤵
PID:14344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 10688 -ip 10688
1⤵
PID:14340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 11824 -ip 11824
1⤵
PID:12884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1416 -p 11368 -ip 11368
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 7108 -ip 7108
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 13136 -ip 13136
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 8084 -ip 8084
1⤵
PID:16204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1320 -p 3188 -ip 3188
1⤵
PID:15080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 12268 -ip 12268
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 11368 -ip 11368
1⤵
PID:14532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 7108 -ip 7108
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 13136 -ip 13136
1⤵
PID:10928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 11824 -ip 11824
1⤵
PID:15592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 12268 -ip 12268
1⤵
PID:15596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1320 -p 15420 -ip 15420
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6212 -ip 6212
1⤵
PID:8528

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 14144 -ip 14144
1⤵
PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1440 -p 10320 -ip 10320
1⤵
PID:7948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7028 -ip 7028
1⤵
PID:9200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe

Filesize
468KB

MD5
fda3675ce7c88d3fced633b626bf402f

SHA1
e49f76a8fea0b400dd957390a67026f94c4a332b

SHA256
6d030b5f85d79f82ee3be7b9c946cae2ff131405f82bbf47dc8753bae80a4cf2

SHA512
0c52dc80ce08977109ab55c2bc886cba2869b06cb4c20e3c5ca73d56199cc88e6628adc1ffd4855f4f9ed14aad22fca5446c73874d6aefd553fce3c5db006685

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe

Filesize
468KB

MD5
da54c233a123338f159cea5d4167af0f

SHA1
7551eafee271f055774291f254342649a9cbc608

SHA256
6b04b0318202033a39c3bd1f80ded3b40a5596a27486defccbf4ab805834d767

SHA512
0a88dbb8133a780b39e7de6618f635f3190ea8022a72a5ecbddbcd9e495dde1fbd69c522be1957a56d7f6e437a76e00996cea79d9127495bc368bfc5139facd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe

Filesize
468KB

MD5
b81f3f36a96ce1bf009fdc6c590c06ac

SHA1
fd8c4c22ecf72d182a08f78be2d07f83474b210c

SHA256
41bd8f62c1f91b5234334cc53df4d8f58b25bc66809b913aa4d388852bdb6a02

SHA512
e830c771c882a3eed942199bac607a66a7acd6a9b154a297c398802162db377fed0de85f6eb55609a70f6ba7be865a27a7e72a676f88cd0d6aff0ccb7c644543

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14746.exe

Filesize
468KB

MD5
224ccf3c87bdba1eb09c0cef7a9ee915

SHA1
8bb1a49d08535fd37c2a7eead80b05d068eeb713

SHA256
2ed70b499d30c5a67d371d6c9b1739a64c4346a0a80a136819821756daa1359c

SHA512
28789d664bfc1bc2011335ecc8a8205f157450a31bcf683a6cab1fa5b5f21307eb957af6f8dcb961bca7c3d35cc8020168eb65451cdc7dd2b4c6abeb6f0a96cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe

Filesize
468KB

MD5
0cc1d8ced042163e006ee2677a8ce272

SHA1
47a9e9d200ae5489c42f258603072e2e2f6d6929

SHA256
d7e770251c0dc80197a538dbd6b63573a0141b904f0baa9ff23cdacaac969fcf

SHA512
4424b619bac9d1b40ea1153f1a631aedf475a843c796f3edf95d3a4625f971899a1cd5e94433862ae992a0c6cf40b004b4dc0e5a4eb6c0b0b32ae4d2e886cee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15126.exe

Filesize
468KB

MD5
427456ec18def32ca2abd7ba50932763

SHA1
c543e535c17255ee92bb6ebcd95228b479d67161

SHA256
c5b2aba305e544598b200b5a7f07704694bdcbb9de032726bb4e79216222f8fc

SHA512
e78c877d55b31cb3441273fca31fd630c05619472b89e5f343707b2cf092f157924a555f07c5a2c01ac5535c0643b14a8b3168ac626f4abe647ddca14157ab4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17841.exe

Filesize
468KB

MD5
36c811122d336e017b79f0a6700e0398

SHA1
64f5ce62c5e5f0ec3b6a9e7016b6227226dde5c9

SHA256
fb36761d2621d6c6f17b92aef8ac2e4e2e094b6e69171340677f776d9963227f

SHA512
4cfa91f4e8626f392e61687f5a9c0c3bdd021674a0d9a13c1b088e24727ce8fe704431832597e7af6a41efa42c8c3a1d05d0c7aed34d52865e9474c8739e7305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21300.exe

Filesize
468KB

MD5
8575ee5a8fd423c08f46b04ea4ab7c0c

SHA1
7f0ff1e3955138f88541fd56adf20168bb8b880c

SHA256
79110fb7a1f37c4acb388c730240b92744f3ff65877496ef308e3eb2e3b8889f

SHA512
d40abfe9c819a6abd9199a36b5565e753d7a095d8035b2248ece6f60612ba546fba01ebf38f37560541da08bdd206f328d1a198208b8a2f7956a7ecaca4dc548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe

Filesize
468KB

MD5
f0c1ac9e7ba32c4c3fbb35f8d836eb9d

SHA1
b85ae1e20f50b708e459a2e44a3c03a49e966e73

SHA256
8a5c26d1cc1be2942303d97dbfc4b3e2d080bbcdc5e58cdc055b3689affe2832

SHA512
deafcd4cf0e4e687d75881c272748ee1a4ff4e144af1fc092f2ff362d41e204936056c66c91c10544313c04421c0094bec0d3a1ece6377d8d4049092fdbb41d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23287.exe

Filesize
468KB

MD5
e8040abe10ee5ecf0dd80473b53e85d9

SHA1
7c4646f4f04be514be80fbf89d8ef742e7b04ef7

SHA256
ecaca221eeebaa666c0fc4df9749058f0e362b552cbe019a6939371a906dabb0

SHA512
ee9c8ad8b69f538ed20a87014a695ab56d5ed5617f2cbb68bfb32e448f0b871f6be578f0cb5476a17042621aa82e12811478c840ccb509511674c603c4a0b703

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe

Filesize
468KB

MD5
44bf930f481cbf5956c78795b23b2ce4

SHA1
51de1f3f3547f13f22a3694324c0385c65862667

SHA256
66089c9b8c2fe57021cda11a10582434f09a4b467e4ebd62a5a72ef9c56a5b43

SHA512
065ed3da6ef7082c6fc98e488ad58852164c8879d9566595905d8844ea0be89f99665bed49b378f33e2f519ce3124a05c3e20139f6e49ce21796f0b2ffa31c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23972.exe

Filesize
468KB

MD5
7ca22451e2a7563f895d842a935f1721

SHA1
b8f300f9ff7fdcf2d28e8df54b9f6e71e3080d60

SHA256
d69793526d1e18f2fc7c886d8ef1015d89483005da606054b330fb61b734cea3

SHA512
0df14e979a5ea131643d2d0786b0ff230f003098f69e09707feb8d2952e5bbcbb4f64f07ba8ffb67180b9fd4bb2fede4e7466aa3388db7ee679b975dd8ad1761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2586.exe

Filesize
468KB

MD5
8c956affd4dbfc065189cd1857dd693c

SHA1
9c88dad02d9e8abe152356cb416f39dce3376d10

SHA256
e5cff496c6a951495eb7be9a123ca9c3b3ffefec07459852a536f7a727f96add

SHA512
e9b45818fca725ef19b0c39b203f1d98c1e2e1476f8c41f31f7eced8cfd6f62c086c944d44563b89d981f7f10f25a06f635f3be74cb6a05f3d7f0ce39948177b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe

Filesize
468KB

MD5
04eeb6fdc316b0bf4b8d80d9aa790d00

SHA1
9fb8ef625b68f427133d13d46fc32acbf35ca10e

SHA256
319eb05facfa6d990a7f38f7509be063777ed56de7df8c5ed0eddb1081eb6910

SHA512
741271f5538cc553f63e170492f31d92e6347aec0a9ca20b41e6aa813552a3012d5a3b9fc9567d36d4f4819f0bb583ab0421c30f39e937043035ff42e31f6cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe

Filesize
468KB

MD5
04ef10639856a87bd6b0dfed0314972c

SHA1
3b2688e95adfc4d5329dd4bac9268747554100ed

SHA256
0f7d20622ea466247f6e8471d2e0e455326eb5d725dddae1a524ec0935866a18

SHA512
368c0bd9bcc18a89a46beb6872667304fdf64d9ff5d14541dc376b4c74bdb1304f0aa1e10168a0ed6f7849c6fb3648f6d56d8e95b69e7ae22736cdbf0e615087

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe

Filesize
468KB

MD5
84a3f6bc198d8a1b23ebb17027b8fae7

SHA1
5c6c042c32e67650b8a5ebfd0832af355b286f56

SHA256
3a633268faab8b1861eca7db19945844d7811412c6247248b1f2a06cb66a6ba4

SHA512
f4e799bb8b04d13a1547bcdac98476cdc529a6c5221846d62c9abe681013c443631709fa5feffb7866bfae5f76288baa223b78db19b7691ec9fbf60916eb28f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34158.exe

Filesize
468KB

MD5
4012fb3498af31aa88a6c1e79a5c2465

SHA1
5a40cb569234ff7fcf0dd52f628265b378ac2212

SHA256
8496f4539adaa8fce2b9b14d02c66dba173e47b817dbb63471d716163c3f12d6

SHA512
bffdbee203fc603fb4477a3a6a16c081d4522c7e575feb400bd1a3e1116cf6af804691503661118999018fc689cd7f882647873f7512ee5c4531797671447bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe

Filesize
468KB

MD5
6fdbc44628db36002bb91c9dfab86ede

SHA1
0d7a2d25bf7822cd2dbb7139340d6fa3a0878ea9

SHA256
b03883e236c3c6659c6c9c63eb7683fca6db7148bc47015bb95660f67ec8b548

SHA512
0af7fda0deef363c63ba5513d85cd6d4f0257463aca6ce29a334aeb58c72c6c9bf694a06a32b50be2d16b27fc09d650baf907c25a723485d3fcb12ec0d14f725

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe

Filesize
468KB

MD5
4e030398d1bb808358bb7e704ddd8e67

SHA1
b092637d1171e78810d3f8e9403598662472849e

SHA256
2db8b3ecf934d6122db3168babfe363137d807f15776f89dd7b5fe4b46bfeca0

SHA512
2e36576ff86fc053d79a144cd0afb8a6db2b8bbee7a9936cb0a3b8148e8c6ba3c34910bb252693bf46e0f4ff89ce4f07570269943ea535364f72fa6f10193e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe

Filesize
468KB

MD5
4b55c48927dca1a3007417a511ea3d68

SHA1
b6338cbffda7e24b96e4230b0490816dfbfdd48f

SHA256
b766b7a981e958913c160e3a610df8119f48a8a8c2e08853e70d6671c94bbb56

SHA512
02c5ffcb2da2dcc234afe2d05b07d66f6d92a572224eac4b5d2bd2496a159d2811ae916dc988b96fd409f431df9751ed1132d4b7c46c4b8184c32024af9ab4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42436.exe

Filesize
468KB

MD5
3fb177bdadecf9411a6412bf5f4b0056

SHA1
b1f94bd1a44b3f340320fb4908f329752ac8893a

SHA256
731a1711927e71288275cf54508c6e6a74fb90f3256b277627ef6a8e88ec9f0a

SHA512
f32fff8994783ddc7ff70d1746ce2ef336e0b31a62c6bbe3e749c04c53a74d270c125f97ebfa999dd5a92854ec4378a0b464c9595d26167201a2922c92f303c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43671.exe

Filesize
468KB

MD5
f611404431eb27ead1fa556d31feacbe

SHA1
489f3513d939acbc16b442f94a39db384df36e14

SHA256
9607dfd9107107097ecbbf99fb39714419fbdb4935fc8228db77c4bea1712307

SHA512
04607294a0b9770778392d0bea713a49a30c5d2cbaadae2d5e5061feb61f7bded449a405f5d08f02e1e25f961a232226de1d8a720ccd181f7c6d8481a8a9637c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49534.exe

Filesize
468KB

MD5
b677cddafa870f6790e725a711252f47

SHA1
868a47b695f93c74caaf076942f7ecf949a9d625

SHA256
679ba2c684cf0929d488918e215fb2150cb24274905d5dc5c16103e580dec338

SHA512
e37b6b976a4927aad35a1a57b752825e7014d13f31e353c6e363488554520516c77621710baaf9f5e9af76dcaade1acaeb17e714b73e519fee62bffddc5af2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51755.exe

Filesize
468KB

MD5
835dd70024cd47e7eeaf0f4a174b7324

SHA1
285196be2cf3020a27257245f30ac5360e8f2c94

SHA256
4d8db5f042c48349bae29296876e31dc8fec0972dd16d179d8fef02b2304db60

SHA512
0a8a1ab005c5207056c763e2ad89f8ee8f262ac4b3da091ae1c5736b84e3a43cb794cf3d648315590bf00e87660ac0a61d5c9bb550e340b670df2cf60b0ee22d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53940.exe

Filesize
468KB

MD5
eae48bc22afa0e338406108462c6f853

SHA1
cd2767afd17fa86c7c1335425519ea7ed62fc82a

SHA256
d2c3ca91aa3dc9430f694b638a9cb2f2a7db3948aa4781d911c9d2d30bf069a1

SHA512
9ae77c98a754b340446c03808a7fdf30af0a976b4f1dd12744b7330b8922eb3e21235af73f915f0025efb862fc98dcc475cc09a806d9907fd95b4927b19229f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe

Filesize
468KB

MD5
f3a8002037e0b5b8b409351b58c55be4

SHA1
0aedf8ff54866cac8328def0161d8b983161202e

SHA256
4c4bd86807c67d95bc98354d1b6ff135f88220f2b1c2cbc112975a6e39b57d20

SHA512
64209c6e7afb31d5883ae0477de0065216ef3f67625252a14cb988ad00aa0aa2f5905b0f2b5c95676d3d7786015ece5bea51e81b2b4eff715cc496f669449fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe

Filesize
468KB

MD5
dfc14604c6dc435635966fb240ddf857

SHA1
aceca02e74f78b1d18459f6bd68786680b28cfe8

SHA256
dc1e93274c5cdcea51f1ea1f0d147c941a29ac9c36ae21ad1e5d7a6d19bf28a5

SHA512
c1322cf9a56c18345a745e40478fae270f398adf4775d0d2f2d17fe309d6260b6a68abb632ca587c0ec25d3f053f868c3637f635c99bb99ee17a01ce4fe3ca87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57355.exe

Filesize
468KB

MD5
f3a3662118248adc1bffef12284fbc22

SHA1
7d4648fc13e540991ade5ec8807219d326e482d3

SHA256
f5690568defe08a1dd739f33dbb0a2dcb532d3cf76cb9a83a2a2b3dfa7feb7e4

SHA512
87b1799286d094b549d427081052c232aab6e60e1047dc5514677332cb684e17f7e443a835e28593417cd55c868cad211ac94b1863c15e7e0b49453d505ce5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63269.exe

Filesize
468KB

MD5
e88ac7f678ba1d2f10187a08097b3103

SHA1
8c2b00adde92bc04f138b29c2abbd7722c9ac1e8

SHA256
3a9c29d855b9921575a5dcf2cb1efd602c7388363a1e4b6740ebb3611c178a74

SHA512
727325e20495128795a2305183d65beb987c71079f579593b31258b344c97911fe91c7991885b1e870bab5a60a26ce71b823c8625c89e2ac3d80397341dbbf38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe

Filesize
468KB

MD5
e98023e4549027e1a8517b6ac6ef425b

SHA1
ee4e5ab1995375389b6bc02096a3f23408bbfe78

SHA256
2df09e4ea9fc78d4abbd366c38a37e9d4acdd0429b0ed3322f9abb81602b7f5a

SHA512
7755d10f943afe20421ff2827c1a8e12e6e3796d3664717f72b73c7bd6148aac6bbc8a6ea1f346a577de76ecf86458fcc2b5c7de6193d45fc2955cec9590d14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9955.exe

Filesize
468KB

MD5
7307e5baec656f0de3083ffd0dc6d173

SHA1
c8d49764b50cb8444e07a00725410a07123afa84

SHA256
df8f943cb1b7ef63abde7bd792cf3285b5698d8f69524d5e526290a20f045dac

SHA512
ee4a464e2fdf50616f3818a26396494d6d3ac058b1aba5ef427fdda077c9fd583dc84961360467ad41c931244908e4cc096ed4bf9de37f7cca08293939c915b2

Download Submit