f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf

Analysis

max time kernel
66s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe
Size

468KB
MD5

13068036803733546df3d83b7aecd1f5
SHA1

a8b623da043ee8d95d13321358447366aabd1f2f
SHA256

f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf
SHA512

e492b54a7f0d6cf317fb4bd393de04473b6b688de38b3729ee417dd1576335404ae3ca4a2b63957d75a7bfb21a74a8450ecd8799aee7c882e17fcfe4e329fa67
SSDEEP

3072:sO3HogISIE5TtbY2HzcOcf8/ACcaP0pkJVHeTVPyF6NLRqggEBlL:sO3obMTtxH4OcfAY10F6pkggE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1472	Unicorn-51427.exe
388	Unicorn-19958.exe
4968	Unicorn-39824.exe
4828	Unicorn-34915.exe
4576	Unicorn-1474.exe
1736	Unicorn-60881.exe
1476	Unicorn-31878.exe
2976	Unicorn-6015.exe
2244	Unicorn-33705.exe
3288	Unicorn-4562.exe
2684	Unicorn-31296.exe
2912	Unicorn-37427.exe
1784	Unicorn-21091.exe
4980	Unicorn-52922.exe
2780	Unicorn-33321.exe
2984	Unicorn-37827.exe
4292	Unicorn-20649.exe
620	Unicorn-7650.exe
1068	Unicorn-17280.exe
4248	Unicorn-39363.exe
3676	Unicorn-46961.exe
1204	Unicorn-59264.exe
4832	Unicorn-25523.exe
4300	Unicorn-41283.exe
1800	Unicorn-26016.exe
2524	Unicorn-19008.exe
4280	Unicorn-21417.exe
4468	Unicorn-37945.exe
3792	Unicorn-57811.exe
4004	Unicorn-54474.exe
3032	Unicorn-8537.exe
532	Unicorn-50346.exe
3804	Unicorn-4674.exe
4592	Unicorn-54560.exe
4396	Unicorn-48430.exe
4596	Unicorn-10450.exe
464	Unicorn-23449.exe
4672	Unicorn-43808.exe
3168	Unicorn-42666.exe
3212	Unicorn-42931.exe
3604	Unicorn-58691.exe
1864	Unicorn-16889.exe
1164	Unicorn-23558.exe
4204	Unicorn-60227.exe
2600	Unicorn-42691.exe
4324	Unicorn-29667.exe
3164	Unicorn-56702.exe
4788	Unicorn-12754.exe
1916	Unicorn-45619.exe
4264	Unicorn-10486.exe
2624	Unicorn-55249.exe
3904	Unicorn-12370.exe
5076	Unicorn-28899.exe
2232	Unicorn-28899.exe
1568	Unicorn-55137.exe
5056	Unicorn-64067.exe
1776	Unicorn-48800.exe
3056	Unicorn-15058.exe
5100	Unicorn-14793.exe
3612	Unicorn-8928.exe
1064	Unicorn-43818.exe
4856	Unicorn-6527.exe
3080	Unicorn-38323.exe
1520	Unicorn-18073.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
216	3288	WerFault.exe	103
4540	2684	WerFault.exe	104
5732	2684	WerFault.exe	104
5772	3288	WerFault.exe	103
5636	4788	WerFault.exe	141
5416	5056	WerFault.exe	149
5584	532	WerFault.exe	125
6972	5696	WerFault.exe	194
6300	4368	WerFault.exe	218
6808	4568	WerFault.exe	174
7432	5504	WerFault.exe	189
8048	6096	WerFault.exe	229
5900	1204	WerFault.exe	115
9024	5808	WerFault.exe	236
10744	1520	WerFault.exe	162
11100	5416	WerFault.exe	376
10704	7792	WerFault.exe	394
10092	7724	WerFault.exe	358
11680	3320	WerFault.exe	171
11468	6600	WerFault.exe	447
12172	6296	WerFault.exe	295
12352	7100	WerFault.exe	285
12600	3276	WerFault.exe	322
12344	6688	WerFault.exe	300
12336	6184	WerFault.exe	332
12328	6440	WerFault.exe	301
12312	7320	WerFault.exe	346
12304	8100	WerFault.exe	409
12296	6896	WerFault.exe	277
6576	5588	WerFault.exe	254
12152	6836	WerFault.exe	273
5560	8208	WerFault.exe	453
12000	9048	WerFault.exe	489
6652	4324	WerFault.exe	427
6508	8060	WerFault.exe	442
7028	8480	WerFault.exe	465
9016	216	WerFault.exe	410
5436	8540	WerFault.exe	468
10200	8112	WerFault.exe	407
10388	8436	WerFault.exe	462
11004	732	WerFault.exe	441
8264	6044	WerFault.exe	403
5828	6152	WerFault.exe	418
5392	5864	WerFault.exe	250
12140	8528	WerFault.exe	467
12132	6400	WerFault.exe	411
11936	3644	WerFault.exe	423
11916	5196	WerFault.exe	180
6024	8680	WerFault.exe	474
10852	8288	WerFault.exe	457
11736	4920	WerFault.exe	445
11324	4364	WerFault.exe	434
10444	1860	WerFault.exe	424
11272	7864	WerFault.exe	443
9320	7708	WerFault.exe	357
12680	8688	WerFault.exe	475
12616	4968	WerFault.exe	93
12688	8416	WerFault.exe	461
8308	8648	WerFault.exe	472
6936	9056	WerFault.exe	490
5840	5304	WerFault.exe	183
7152	6076	WerFault.exe	413
12968	2600	WerFault.exe	138
6180	1860	WerFault.exe	424

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33705.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe
1472	Unicorn-51427.exe
388	Unicorn-19958.exe
4968	Unicorn-39824.exe
4828	Unicorn-34915.exe
4576	Unicorn-1474.exe
1736	Unicorn-60881.exe
1476	Unicorn-31878.exe
2976	Unicorn-6015.exe
2244	Unicorn-33705.exe
4980	Unicorn-52922.exe
1784	Unicorn-21091.exe
3288	Unicorn-4562.exe
2684	Unicorn-31296.exe
2912	Unicorn-37427.exe
2780	Unicorn-33321.exe
2984	Unicorn-37827.exe
4292	Unicorn-20649.exe
620	Unicorn-7650.exe
1068	Unicorn-17280.exe
4248	Unicorn-39363.exe
3676	Unicorn-46961.exe
1204	Unicorn-59264.exe
4832	Unicorn-25523.exe
4280	Unicorn-21417.exe
4004	Unicorn-54474.exe
2524	Unicorn-19008.exe
4468	Unicorn-37945.exe
4300	Unicorn-41283.exe
3032	Unicorn-8537.exe
1800	Unicorn-26016.exe
3792	Unicorn-57811.exe
532	Unicorn-50346.exe
3804	Unicorn-4674.exe
4592	Unicorn-54560.exe
4396	Unicorn-48430.exe
4596	Unicorn-10450.exe
464	Unicorn-23449.exe
4672	Unicorn-43808.exe
3212	Unicorn-42931.exe
3604	Unicorn-58691.exe
1864	Unicorn-16889.exe
1164	Unicorn-23558.exe
3168	Unicorn-42666.exe
4204	Unicorn-60227.exe
2600	Unicorn-42691.exe
3164	Unicorn-56702.exe
4788	Unicorn-12754.exe
1916	Unicorn-45619.exe
4264	Unicorn-10486.exe
2624	Unicorn-55249.exe
5076	Unicorn-28899.exe
2232	Unicorn-28899.exe
3904	Unicorn-12370.exe
5056	Unicorn-64067.exe
3612	Unicorn-8928.exe
1776	Unicorn-48800.exe
5100	Unicorn-14793.exe
1064	Unicorn-43818.exe
1568	Unicorn-55137.exe
3056	Unicorn-15058.exe
4856	Unicorn-6527.exe
3080	Unicorn-38323.exe
1520	Unicorn-18073.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 1472	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	89
PID 2736 wrote to memory of 1472	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	89
PID 2736 wrote to memory of 1472	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	89
PID 2736 wrote to memory of 388	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	92
PID 2736 wrote to memory of 388	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	92
PID 2736 wrote to memory of 388	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	92
PID 1472 wrote to memory of 4968	1472	Unicorn-51427.exe	93
PID 1472 wrote to memory of 4968	1472	Unicorn-51427.exe	93
PID 1472 wrote to memory of 4968	1472	Unicorn-51427.exe	93
PID 388 wrote to memory of 4828	388	Unicorn-19958.exe	95
PID 388 wrote to memory of 4828	388	Unicorn-19958.exe	95
PID 388 wrote to memory of 4828	388	Unicorn-19958.exe	95
PID 4968 wrote to memory of 4576	4968	Unicorn-39824.exe	96
PID 4968 wrote to memory of 4576	4968	Unicorn-39824.exe	96
PID 4968 wrote to memory of 4576	4968	Unicorn-39824.exe	96
PID 2736 wrote to memory of 1736	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	97
PID 2736 wrote to memory of 1736	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	97
PID 2736 wrote to memory of 1736	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	97
PID 1472 wrote to memory of 1476	1472	Unicorn-51427.exe	98
PID 1472 wrote to memory of 1476	1472	Unicorn-51427.exe	98
PID 1472 wrote to memory of 1476	1472	Unicorn-51427.exe	98
PID 4576 wrote to memory of 2976	4576	Unicorn-1474.exe	101
PID 4576 wrote to memory of 2976	4576	Unicorn-1474.exe	101
PID 4576 wrote to memory of 2976	4576	Unicorn-1474.exe	101
PID 4968 wrote to memory of 2244	4968	Unicorn-39824.exe	102
PID 4968 wrote to memory of 2244	4968	Unicorn-39824.exe	102
PID 4968 wrote to memory of 2244	4968	Unicorn-39824.exe	102
PID 1476 wrote to memory of 3288	1476	Unicorn-31878.exe	103
PID 1476 wrote to memory of 3288	1476	Unicorn-31878.exe	103
PID 1476 wrote to memory of 3288	1476	Unicorn-31878.exe	103
PID 1472 wrote to memory of 2684	1472	Unicorn-51427.exe	104
PID 1472 wrote to memory of 2684	1472	Unicorn-51427.exe	104
PID 1472 wrote to memory of 2684	1472	Unicorn-51427.exe	104
PID 1736 wrote to memory of 2912	1736	Unicorn-60881.exe	105
PID 1736 wrote to memory of 2912	1736	Unicorn-60881.exe	105
PID 1736 wrote to memory of 2912	1736	Unicorn-60881.exe	105
PID 4828 wrote to memory of 1784	4828	Unicorn-34915.exe	106
PID 4828 wrote to memory of 1784	4828	Unicorn-34915.exe	106
PID 4828 wrote to memory of 1784	4828	Unicorn-34915.exe	106
PID 2736 wrote to memory of 4980	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	107
PID 2736 wrote to memory of 4980	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	107
PID 2736 wrote to memory of 4980	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	107
PID 388 wrote to memory of 2780	388	Unicorn-19958.exe	108
PID 388 wrote to memory of 2780	388	Unicorn-19958.exe	108
PID 388 wrote to memory of 2780	388	Unicorn-19958.exe	108
PID 2976 wrote to memory of 2984	2976	Unicorn-6015.exe	109
PID 2976 wrote to memory of 2984	2976	Unicorn-6015.exe	109
PID 2976 wrote to memory of 2984	2976	Unicorn-6015.exe	109
PID 4576 wrote to memory of 4292	4576	Unicorn-1474.exe	110
PID 4576 wrote to memory of 4292	4576	Unicorn-1474.exe	110
PID 4576 wrote to memory of 4292	4576	Unicorn-1474.exe	110
PID 2244 wrote to memory of 620	2244	Unicorn-33705.exe	111
PID 2244 wrote to memory of 620	2244	Unicorn-33705.exe	111
PID 2244 wrote to memory of 620	2244	Unicorn-33705.exe	111
PID 4968 wrote to memory of 1068	4968	Unicorn-39824.exe	112
PID 4968 wrote to memory of 1068	4968	Unicorn-39824.exe	112
PID 4968 wrote to memory of 1068	4968	Unicorn-39824.exe	112
PID 4980 wrote to memory of 4248	4980	Unicorn-52922.exe	113
PID 4980 wrote to memory of 4248	4980	Unicorn-52922.exe	113
PID 4980 wrote to memory of 4248	4980	Unicorn-52922.exe	113
PID 2736 wrote to memory of 3676	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	114
PID 2736 wrote to memory of 3676	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	114
PID 2736 wrote to memory of 3676	2736	f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe	114
PID 2912 wrote to memory of 1204	2912	Unicorn-37427.exe	115

C:\Users\Admin\AppData\Local\Temp\f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe
"C:\Users\Admin\AppData\Local\Temp\f018357caae271128bdb64c9cbdbafc56a52a2ba5853c903f90113f68d4a40cf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40643.exe
        9⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        11⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48403.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22342.exe
        12⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 728
        11⤵
        Program crash
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16406.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        11⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        11⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30461.exe
        10⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60775.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7337.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49728.exe
        10⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        11⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12802.exe
        12⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48535.exe
        12⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 628
        11⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        10⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53950.exe
        10⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24791.exe
        10⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        10⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 748
        9⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        9⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        10⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 636
        11⤵
        Program crash
        
        PID:11324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 652
        10⤵
        Program crash
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        9⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25242.exe
        9⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64931.exe
        10⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56442.exe
        10⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
        9⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7244 -s 656
        9⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42976.exe
        9⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65057.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9314.exe
        8⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 676
        9⤵
        Program crash
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        8⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 636
        8⤵
        Program crash
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8688 -s 652
        8⤵
        Program crash
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48182.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        7⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35360.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        9⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40496.exe
        10⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25731.exe
        11⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28947.exe
        12⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        11⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16403.exe
        12⤵
        
        PID:14436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 636
        10⤵
        Program crash
        
        PID:12152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 712
        7⤵
        Program crash
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47569.exe
        6⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-783.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46458.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        9⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        9⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15030.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17869.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8432 -s 636
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
        7⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        7⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7508 -s 636
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4217.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13295.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52606.exe
        7⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        6⤵
        
        PID:732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 640
        7⤵
        Program crash
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        6⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38469.exe
        6⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54560.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12418.exe
        10⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5769.exe
        10⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
        9⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
        9⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        8⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7724 -s 632
        9⤵
        Program crash
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        8⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 720
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        8⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 636
        9⤵
        Program crash
        
        PID:10444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 636
        9⤵
        Program crash
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41993.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        9⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 616
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        7⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8680 -s 636
        8⤵
        Program crash
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32103.exe
        7⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 504
        7⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        6⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32208.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15311.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 728
        8⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18057.exe
        7⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 624
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64154.exe
        6⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 632
        7⤵
        Program crash
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39774.exe
        6⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51031.exe
        7⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8386.exe
        6⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48430.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37555.exe
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        8⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 724
        8⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49447.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63952.exe
        8⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32944.exe
        9⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48112.exe
        10⤵
        
        PID:14916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 636
        9⤵
        
        PID:15008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7320 -s 720
        8⤵
        Program crash
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2285.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64718.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22931.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44862.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33062.exe
        7⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 624
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        6⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6600 -s 640
        7⤵
        Program crash
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63898.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61822.exe
        6⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20953.exe
        5⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54483.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40614.exe
        6⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 640
        7⤵
        Program crash
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        7⤵
        
        PID:5528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 740
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19305.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58291.exe
        5⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61112.exe
        5⤵
        
        PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33705.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10450.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11919.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17312.exe
        9⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2905.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40304.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31875.exe
        9⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        9⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        9⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 664
        8⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-463.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50528.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56858.exe
        7⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
        6⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-745.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        8⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2057.exe
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        6⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36416.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13705.exe
        7⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6338.exe
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23449.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
        6⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13334.exe
        7⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7864 -s 636
        8⤵
        Program crash
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13871.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10806.exe
        7⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        6⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        7⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2902.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        5⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        8⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        7⤵
        
        PID:14344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 736
        5⤵
        
        PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22755.exe
        6⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62163.exe
        7⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 712
        8⤵
        Program crash
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        8⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 648
        8⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20477.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16294.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47921.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34185.exe
        7⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27952.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8968 -s 668
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2413.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        7⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21862.exe
        6⤵
        
        PID:6812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 684
        6⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        6⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6400 -s 640
        7⤵
        Program crash
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59207.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64622.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27175.exe
        5⤵
        
        PID:8528
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8528 -s 636
        6⤵
        Program crash
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13728.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44726.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51552.exe
        5⤵
        
        PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        6⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8112 -s 636
        7⤵
        Program crash
        
        PID:10200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 656
        6⤵
        Program crash
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31856.exe
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        6⤵
        
        PID:9388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 652
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        5⤵
        
        PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11535.exe
      4⤵
      PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        5⤵
        
        PID:9428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8236 -s 688
        5⤵
        
        PID:14132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 756
      4⤵
      Program crash
      PID:12616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48800.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 660
        5⤵
        Program crash
        
        PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 660
        5⤵
        Program crash
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        5⤵
        Executes dropped EXE
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26537.exe
        5⤵
        
        PID:5504
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 628
        6⤵
        Program crash
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        5⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        5⤵
        
        PID:8924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8924 -s 636
        6⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42998.exe
        5⤵
        
        PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56702.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6543.exe
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
        6⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62807.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18925.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        7⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:10036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 628
        6⤵
        
        PID:14712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe
      4⤵
      PID:12816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15058.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe
        6⤵
        
        PID:5868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 728
        6⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
        5⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49344.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-79.exe
        8⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7996 -s 632
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        7⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-991.exe
        7⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60561.exe
        6⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35024.exe
        7⤵
        
        PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61345.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        5⤵
        
        PID:9056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9056 -s 632
        6⤵
        Program crash
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
        5⤵
        
        PID:10288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 740
      4⤵
      Program crash
      PID:4540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 748
      4⤵
      Program crash
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47610.exe
        5⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        6⤵
        
        PID:4676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 636
        6⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 764
        5⤵
        
        PID:14548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55137.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33331.exe
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31574.exe
      4⤵
      PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
    3⤵
    PID:4368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 640
      4⤵
      Program crash
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
    3⤵
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17248.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41680.exe
        5⤵
        
        PID:8396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7848 -s 724
        5⤵
        
        PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      4⤵
      PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57920.exe
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        5⤵
        
        PID:14772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
    3⤵
    PID:232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
    3⤵
    PID:12212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59978.exe
    3⤵
    PID:8072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47939.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30275.exe
        8⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3817.exe
        7⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8480 -s 636
        8⤵
        Program crash
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24909.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2050.exe
        8⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        6⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 636
        7⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42494.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41.exe
        6⤵
        
        PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        6⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 724
        7⤵
        Program crash
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43850.exe
        6⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15357.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-889.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        6⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11680.exe
        5⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29571.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15910.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        6⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56202.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19061.exe
        5⤵
        
        PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36512.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64935.exe
        7⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16966.exe
        6⤵
        
        PID:7340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 632
        6⤵
        
        PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48778.exe
        5⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        7⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50391.exe
        6⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24730.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16509.exe
        5⤵
        
        PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13362.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6198.exe
        6⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        5⤵
        
        PID:9396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 636
        5⤵
        
        PID:14340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
      4⤵
      PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        5⤵
        
        PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10552.exe
      4⤵
      PID:12888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57441.exe
      4⤵
      PID:14852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32755.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63651.exe
        8⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 632
        9⤵
        Program crash
        
        PID:11936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 628
        8⤵
        Program crash
        
        PID:12352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 628
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        7⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8540 -s 636
        8⤵
        Program crash
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41438.exe
        7⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52208.exe
        6⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 632
        7⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2598.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21552.exe
        6⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19481.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23299.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        7⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        6⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
        7⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13449.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19376.exe
        6⤵
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18752.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43818.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3839.exe
        5⤵
        
        PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28544.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31811.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25254.exe
        5⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        5⤵
        
        PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-335.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        6⤵
        
        PID:9716
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8056 -s 660
        6⤵
        
        PID:15120
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 660
        5⤵
        Program crash
        
        PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44353.exe
      4⤵
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
        5⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
        6⤵
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17106.exe
      4⤵
      PID:13668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 640
        5⤵
        Program crash
        
        PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      4⤵
      PID:6016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25744.exe
    3⤵
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22211.exe
      4⤵
      PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47424.exe
        5⤵
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29366.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        5⤵
        
        PID:10436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6684 -s 632
        5⤵
        
        PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
      4⤵
      PID:8436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8436 -s 640
        5⤵
        Program crash
        
        PID:10388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8436 -s 640
        5⤵
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37063.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
      4⤵
      PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58538.exe
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
    3⤵
    PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
      4⤵
      PID:9884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8904 -s 652
      4⤵
      PID:15048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50309.exe
    3⤵
    PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
      4⤵
      PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
    3⤵
    PID:13600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
    3⤵
    PID:9324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60227.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41648.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35632.exe
        9⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39913.exe
        9⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        8⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4512.exe
        8⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 628
        7⤵
        Program crash
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        7⤵
        
        PID:216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 636
        8⤵
        Program crash
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8937.exe
        7⤵
        
        PID:10244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 716
        5⤵
        Program crash
        
        PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42691.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63315.exe
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
        6⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16608.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61930.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47456.exe
        8⤵
        
        PID:14108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 660
        6⤵
        Program crash
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        5⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14703.exe
        6⤵
        
        PID:11224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 504
        5⤵
        Program crash
        
        PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12381.exe
        7⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64199.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47514.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16704.exe
        5⤵
        
        PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43466.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4788
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 648
        5⤵
        Program crash
        
        PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13849.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14626.exe
        6⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7376 -s 636
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13929.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4256.exe
        6⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7688 -s 624
        6⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        5⤵
        
        PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        5⤵
        
        PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
      4⤵
      PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50416.exe
        5⤵
        
        PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5474.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32752.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33040.exe
        8⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        7⤵
        
        PID:10276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 648
        6⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29075.exe
        6⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 628
        7⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52586.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        5⤵
        
        PID:12780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25312.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26608.exe
        6⤵
        
        PID:9664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7560 -s 668
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        5⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        6⤵
        
        PID:14064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16521.exe
        5⤵
        
        PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
      4⤵
      PID:8648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8648 -s 636
        5⤵
        Program crash
        
        PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
      4⤵
      PID:11152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 688
      4⤵
      PID:14852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30109.exe
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
    3⤵
    PID:9048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9048 -s 636
      4⤵
      Program crash
      PID:12000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9048 -s 636
      4⤵
      PID:14268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5919.exe
    3⤵
    PID:11008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27841.exe
    3⤵
    PID:14584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41395.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47779.exe
        9⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40086.exe
        9⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47815.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35838.exe
        8⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        7⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21145.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6562.exe
        6⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 636
        7⤵
        Program crash
        
        PID:8264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 740
        6⤵
        Program crash
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        5⤵
        
        PID:8416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8416 -s 636
        6⤵
        Program crash
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42974.exe
        5⤵
        
        PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47507.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33712.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        6⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
      4⤵
      PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        5⤵
        
        PID:13060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exe
      4⤵
      PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
        6⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        8⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 672
        8⤵
        
        PID:15088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 672
        8⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48727.exe
        7⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        8⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        6⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49840.exe
        7⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        6⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45239.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24000.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 624
        5⤵
        Program crash
        
        PID:11916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        5⤵
        
        PID:4324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 636
        6⤵
        Program crash
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        5⤵
        
        PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
      4⤵
      PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28368.exe
        5⤵
        
        PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31927.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21619.exe
      4⤵
      PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12265.exe
      4⤵
      PID:8060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 636
        5⤵
        Program crash
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31904.exe
      4⤵
      PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14518.exe
        5⤵
        
        PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
      4⤵
      PID:2572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50497.exe
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50743.exe
    3⤵
    PID:11576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26624.exe
    3⤵
    PID:13900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
      4⤵
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29491.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        7⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37958.exe
        6⤵
        
        PID:7744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 624
        6⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        5⤵
        
        PID:7792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 636
        6⤵
        Program crash
        
        PID:10704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 740
        5⤵
        Program crash
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18473.exe
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        5⤵
        
        PID:8100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8100 -s 636
        6⤵
        Program crash
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30141.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 636
        5⤵
        Program crash
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
      4⤵
      PID:11040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21529.exe
    3⤵
    PID:4568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 628
      4⤵
      Program crash
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32909.exe
    3⤵
    PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27184.exe
        5⤵
        
        PID:9636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7664 -s 668
        5⤵
        
        PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
      4⤵
      PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62458.exe
        5⤵
        
        PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59246.exe
      4⤵
      PID:13944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 648
    3⤵
    PID:5000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16889.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41888.exe
    3⤵
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
        6⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8288 -s 628
        7⤵
        Program crash
        
        PID:10852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 664
        6⤵
        Program crash
        
        PID:12336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 680
        6⤵
        
        PID:10608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 680
        5⤵
        
        PID:14596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5416
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 636
        5⤵
        Program crash
        
        PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51694.exe
      4⤵
      PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31635.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
        5⤵
        
        PID:4552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 664
      4⤵
      PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
    3⤵
    PID:6296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 628
      4⤵
      Program crash
      PID:12172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1766.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33104.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
    3⤵
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
      4⤵
      PID:6152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 636
        5⤵
        Program crash
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17401.exe
      4⤵
      PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
      4⤵
      PID:13320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    3⤵
    PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62231.exe
      4⤵
      PID:12608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
    3⤵
    PID:9296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
    3⤵
    PID:13844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
    3⤵
    PID:2992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
  2⤵
  PID:6528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9551.exe
    3⤵
    PID:6076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 624
      4⤵
      Program crash
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
    3⤵
    PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
      4⤵
      PID:3044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
  2⤵
  PID:8580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51776.exe
    3⤵
    PID:8728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8580 -s 668
    3⤵
    PID:15104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1302.exe
  2⤵
  PID:10404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11950.exe
  2⤵
  PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
    3⤵
    PID:13836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
  2⤵
  PID:13088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3288 -ip 3288
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2684 -ip 2684
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3288 -ip 3288
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2684 -ip 2684
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4788 -ip 4788
1⤵
PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5056 -ip 5056
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4468 -ip 4468
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1800 -ip 1800
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2524 -ip 2524
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3032 -ip 3032
1⤵
PID:5752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 532 -ip 532
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4468 -ip 4468
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3032 -ip 3032
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 532 -ip 532
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1800 -ip 1800
1⤵
PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2524 -ip 2524
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3136 -ip 3136
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5696 -ip 5696
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5420 -ip 5420
1⤵
PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4568 -ip 4568
1⤵
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4672 -ip 4672
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3136 -ip 3136
1⤵
PID:6792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6064 -ip 6064
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4368 -ip 4368
1⤵
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6044 -ip 6044
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5420 -ip 5420
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4568 -ip 4568
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5996 -ip 5996
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5912 -ip 5912
1⤵
PID:6796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5136 -ip 5136
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4672 -ip 4672
1⤵
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5904 -ip 5904
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5504 -ip 5504
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5896 -ip 5896
1⤵
PID:7012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3168 -ip 3168
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4788 -ip 4788
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6016 -ip 6016
1⤵
PID:6152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4204 -ip 4204
1⤵
PID:7188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2624 -ip 2624
1⤵
PID:7352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 3164 -ip 3164
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4376 -ip 4376
1⤵
PID:7580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6096 -ip 6096
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5796 -ip 5796
1⤵
PID:7688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6064 -ip 6064
1⤵
PID:7804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3604 -ip 3604
1⤵
PID:7812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6044 -ip 6044
1⤵
PID:7856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5056 -ip 5056
1⤵
PID:7916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5076 -ip 5076
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1916 -ip 1916
1⤵
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 4088 -ip 4088
1⤵
PID:8008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4856 -ip 4856
1⤵
PID:8028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 1064 -ip 1064
1⤵
PID:8060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1776 -ip 1776
1⤵
PID:8076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5344 -ip 5344
1⤵
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5996 -ip 5996
1⤵
PID:8108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5912 -ip 5912
1⤵
PID:8140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5136 -ip 5136
1⤵
PID:8188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5904 -ip 5904
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1204 -ip 1204
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5504 -ip 5504
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1832 -ip 1832
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5896 -ip 5896
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5100 -ip 5100
1⤵
PID:6616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5808 -ip 5808
1⤵
PID:7224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6004 -ip 6004
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5988 -ip 5988
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6016 -ip 6016
1⤵
PID:7444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 3168 -ip 3168
1⤵
PID:7628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4204 -ip 4204
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2624 -ip 2624
1⤵
PID:7968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3164 -ip 3164
1⤵
PID:7964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376
1⤵
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5796 -ip 5796
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6096 -ip 6096
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3604 -ip 3604
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5076 -ip 5076
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 1916 -ip 1916
1⤵
PID:7328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4856 -ip 4856
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4088 -ip 4088
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1776 -ip 1776
1⤵
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1064 -ip 1064
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5344 -ip 5344
1⤵
PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6208 -ip 6208
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 1664 -ip 1664
1⤵
PID:7744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1204 -ip 1204
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5096 -ip 5096
1⤵
PID:8168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1832 -ip 1832
1⤵
PID:8576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5988 -ip 5988
1⤵
PID:8808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5100 -ip 5100
1⤵
PID:9140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6004 -ip 6004
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 5808 -ip 5808
1⤵
PID:7548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 6860 -ip 6860
1⤵
PID:7628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6164 -ip 6164
1⤵
PID:7748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5288 -ip 5288
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6844 -ip 6844
1⤵
PID:8476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 6868 -ip 6868
1⤵
PID:8332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6472 -ip 6472
1⤵
PID:8356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5492 -ip 5492
1⤵
PID:8640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 3728 -ip 3728
1⤵
PID:8432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 5696 -ip 5696
1⤵
PID:8596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 7340 -ip 7340
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6652 -ip 6652
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5868 -ip 5868
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6268 -ip 6268
1⤵
PID:7944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 6812 -ip 6812
1⤵
PID:8976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 7212 -ip 7212
1⤵
PID:7920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 7020 -ip 7020
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 6792 -ip 6792
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 6888 -ip 6888
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6296 -ip 6296
1⤵
PID:8552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7044 -ip 7044
1⤵
PID:8384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6984 -ip 6984
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6492 -ip 6492
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 7436 -ip 7436
1⤵
PID:8676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6948 -ip 6948
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3772 -ip 3772
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 6908 -ip 6908
1⤵
PID:8228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6884 -ip 6884
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 7060 -ip 7060
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 7260 -ip 7260
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6180 -ip 6180
1⤵
PID:8676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 6128 -ip 6128
1⤵
PID:8384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6592 -ip 6592
1⤵
PID:9236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3468 -ip 3468
1⤵
PID:9268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7460 -ip 7460
1⤵
PID:9292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 5376 -ip 5376
1⤵
PID:9360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5352 -ip 5352
1⤵
PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5664 -ip 5664
1⤵
PID:9576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5236 -ip 5236
1⤵
PID:9604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4420 -ip 4420
1⤵
PID:9664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2036 -ip 2036
1⤵
PID:9720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1568 -ip 1568
1⤵
PID:9980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 1664 -ip 1664
1⤵
PID:10088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 3904 -ip 3904
1⤵
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3332 -ip 3332
1⤵
PID:10236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 5980 -ip 5980
1⤵
PID:7180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5676 -ip 5676
1⤵
PID:9220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 6208 -ip 6208
1⤵
PID:7184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 3952 -ip 3952
1⤵
PID:9336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 2912 -ip 2912
1⤵
PID:9352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 3056 -ip 3056
1⤵
PID:9472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 3080 -ip 3080
1⤵
PID:9528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5060 -ip 5060
1⤵
PID:9360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5096 -ip 5096
1⤵
PID:9772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 4368 -ip 4368
1⤵
PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 6860 -ip 6860
1⤵
PID:9416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6164 -ip 6164
1⤵
PID:10528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 5288 -ip 5288
1⤵
PID:10536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5492 -ip 5492
1⤵
PID:10620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 6472 -ip 6472
1⤵
PID:11008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 6868 -ip 6868
1⤵
PID:11020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1300 -p 6844 -ip 6844
1⤵
PID:11148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 3728 -ip 3728
1⤵
PID:10160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5480 -ip 5480
1⤵
PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 1520 -ip 1520
1⤵
PID:9980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 7724 -ip 7724
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7792 -ip 7792
1⤵
PID:9584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5416 -ip 5416
1⤵
PID:10424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3676 -ip 3676
1⤵
PID:10764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 7008 -ip 7008
1⤵
PID:10992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 7508 -ip 7508
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 7524 -ip 7524
1⤵
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 6652 -ip 6652
1⤵
PID:10292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7340 -ip 7340
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 6268 -ip 6268
1⤵
PID:11324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 7708 -ip 7708
1⤵
PID:11412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 6812 -ip 6812
1⤵
PID:11596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 5868 -ip 5868
1⤵
PID:11688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7212 -ip 7212
1⤵
PID:11728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 7020 -ip 7020
1⤵
PID:11832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 7044 -ip 7044
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 6296 -ip 6296
1⤵
PID:6864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6888 -ip 6888
1⤵
PID:10764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6792 -ip 6792
1⤵
PID:11196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 7864 -ip 7864
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 6984 -ip 6984
1⤵
PID:7340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3320 -ip 3320
1⤵
PID:11700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 6492 -ip 6492
1⤵
PID:8412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 6948 -ip 6948
1⤵
PID:11808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 7436 -ip 7436
1⤵
PID:12368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3772 -ip 3772
1⤵
PID:12440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 6884 -ip 6884
1⤵
PID:12552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 6908 -ip 6908
1⤵
PID:12572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 6180 -ip 6180
1⤵
PID:12592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1260 -p 7060 -ip 7060
1⤵
PID:12580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 7260 -ip 7260
1⤵
PID:12616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 6128 -ip 6128
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 6592 -ip 6592
1⤵
PID:12680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 3468 -ip 3468
1⤵
PID:12696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 7460 -ip 7460
1⤵
PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1860 -ip 1860
1⤵
PID:12716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5376 -ip 5376
1⤵
PID:12740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 6600 -ip 6600
1⤵
PID:12748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 8680 -ip 8680
1⤵
PID:12760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 5352 -ip 5352
1⤵
PID:13232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 8288 -ip 8288
1⤵
PID:9672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3644 -ip 3644
1⤵
PID:12460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4920 -ip 4920
1⤵
PID:12376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 4364 -ip 4364
1⤵
PID:12724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5196 -ip 5196
1⤵
PID:13096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5236 -ip 5236
1⤵
PID:6592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4420 -ip 4420
1⤵
PID:12756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5664 -ip 5664
1⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1568 -ip 1568
1⤵
PID:13104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2036 -ip 2036
1⤵
PID:9412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5980 -ip 5980
1⤵
PID:13100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 3332 -ip 3332
1⤵
PID:11552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5676 -ip 5676
1⤵
PID:13332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 8528 -ip 8528
1⤵
PID:13340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1312 -p 6400 -ip 6400
1⤵
PID:13348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 6152 -ip 6152
1⤵
PID:13476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 2912 -ip 2912
1⤵
PID:13516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 9048 -ip 9048
1⤵
PID:13524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6044 -ip 6044
1⤵
PID:13572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 732 -ip 732
1⤵
PID:13676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1260 -p 8436 -ip 8436
1⤵
PID:13740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 216 -ip 216
1⤵
PID:12764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 8540 -ip 8540
1⤵
PID:9764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 4324 -ip 4324
1⤵
PID:13648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 8480 -ip 8480
1⤵
PID:13516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 8060 -ip 8060
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 5864 -ip 5864
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 6836 -ip 6836
1⤵
PID:8888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5588 -ip 5588
1⤵
PID:7592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6896 -ip 6896
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 8100 -ip 8100
1⤵
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 7320 -ip 7320
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6440 -ip 6440
1⤵
PID:14096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6688 -ip 6688
1⤵
PID:14104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7100 -ip 7100
1⤵
PID:14160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3276 -ip 3276
1⤵
PID:14168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 5480 -ip 5480
1⤵
PID:14192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8416 -ip 8416
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4968 -ip 4968
1⤵
PID:8700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 8688 -ip 8688
1⤵
PID:13488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1312 -p 8648 -ip 8648
1⤵
PID:14040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 6076 -ip 6076
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 9056 -ip 9056
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 5304 -ip 5304
1⤵
PID:14228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2600 -ip 2600
1⤵
PID:14352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2244 -ip 2244
1⤵
PID:15348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 6172 -ip 6172
1⤵
PID:11708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7376 -ip 7376
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 7848 -ip 7848
1⤵
PID:14084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 2232 -ip 2232
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 7688 -ip 7688
1⤵
PID:14344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 8968 -ip 8968
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 6952 -ip 6952
1⤵
PID:11588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 9888 -ip 9888
1⤵
PID:14532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3644 -ip 3644
1⤵
PID:13556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 6600 -ip 6600
1⤵
PID:15188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 9776 -ip 9776
1⤵
PID:12460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 9236 -ip 9236
1⤵
PID:15140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2744 -ip 2744
1⤵
PID:14584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 8208 -ip 8208
1⤵
PID:7732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1300 -p 9988 -ip 9988
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4472 -ip 4472
1⤵
PID:14172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1564 -p 9692 -ip 9692
1⤵
PID:13804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 9480 -ip 9480
1⤵
PID:14464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 9936 -ip 9936
1⤵
PID:14720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 10028 -ip 10028
1⤵
PID:14436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 9664 -ip 9664
1⤵
PID:14052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 9396 -ip 9396
1⤵
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1632 -p 11740 -ip 11740
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1660 -p 11076 -ip 11076
1⤵
PID:9892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1688 -p 4796 -ip 4796
1⤵
PID:9888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14381.exe

Filesize
468KB

MD5
b17964b77b012c223285962cfc41f194

SHA1
3572cadb22b15ec4c2538019eed639622abfef68

SHA256
f51bec02a25a4f7b93c67df76bbc21af3ad5f26dfa7eb7ab6252ff60b17d13e4

SHA512
c4b24b326aaf36a6a4507c59c2b821e58d05ac4a9c413df9f1951d856c0c20957f3dea89ec5c5c612fddc0230521d59668fe010f6a7d3d96f74b1960ea9319f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe

Filesize
468KB

MD5
818abe377f7e1c79e2355989d2f721a4

SHA1
03420d4662605898dcfb56448d7691a8f3211284

SHA256
35d077f6ff001535febc25b7d4931a41643bb15b7f4ec53d8cc6fb8354f4d506

SHA512
805d4354c8c1216613ee5d0581244b9ce31b3e5d4abeded6d4626f3a468eb0966a91a05202228daa191217a338cc5ff2b95d531bbbb685c36edfb332b113f86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17280.exe

Filesize
468KB

MD5
fe7f582892ba216da9707713f55ca8e6

SHA1
867e16c1b8aba45293c73c9d5111fc07b5fdacf0

SHA256
a266740ad961b00b6943cc55e186916aa39742f54e430b1f67bfebc4cc65b85f

SHA512
7e554dd02a1f1ee6a424f9f5e55a369bf9646c2bd391c04e7d004d92adfe78510f7f48b4a6899c5e808b369d997672c836714d0fb65848e121481a18fd023858

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe

Filesize
468KB

MD5
cf9266ed9c2049e2dfaea1a8e1aa7f94

SHA1
ec63210992cf6fd6191dfaa1738587a260c5ed94

SHA256
36616afcbde2a7c7c6dcb99b93984c4f57e5ca2795fcb897f1ea01849175bc2e

SHA512
423d22bc7bed7667d7c7e7623af4730dcc934029a67bffa3bf8e89956828950a65008e76856dc3e507be3ceb94508aba622d797edbf9986239785bbdb4bee65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19958.exe

Filesize
468KB

MD5
07613e8d15f1c920a37300db2012fda0

SHA1
b4b565c10c47193ff9f309def8989310ab308647

SHA256
e60676ceac14bdaf363074e77d07d38a9815d67b7201162f118135be4fc992fe

SHA512
d670d7437823ea83b98522c3337969b7eff285744d45b290a8f6e2015ef92ee18fb091bae80737f8e6f90baa403cca9a4cbb37df88c45fd056382eb825de7533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe

Filesize
468KB

MD5
20ac994efe9ed9f6b0b9c7e18ac2ee31

SHA1
e9d4be0216690f84da9ca9323bbd34145be4997f

SHA256
a33f1d0685b4df3deb8640336dfc7a0fac93692baff50ac46a415a5447241b1a

SHA512
2978906a7e8a4472dce1fad392343898011cf4735527ef2b713bbcc2d534b3adc7dccd5d12cc5d9c8406e8953246aa3e1b0f8bc3452e0d6e83488e721127d1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21091.exe

Filesize
468KB

MD5
e6b93581dba70132e707f3e1e0fdc000

SHA1
e19a2aa445e70c029d0b0477798bcebd7b3c15d6

SHA256
c8937bcaabae8ac77e1a2438ae08022f9ce75f28cd86e919df07d83c86d6b534

SHA512
4f622f29175759abfb4708c1a6b804adc79d575de8a555ff60c3852bdbb23c4150176dbc0be9c97a1c2593b46d9991997af76bbacd3635e69abb0aca62f9b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe

Filesize
468KB

MD5
c6f1e00fb21be6068d0e6fcfb8b4c6e8

SHA1
cff2beaa0903d65271a7764ef5d2054d12aeec9a

SHA256
b40737bc1a7cc699ec3264c6cf226a908bcb839ab74bd3a93b51dd83be80bd63

SHA512
70cb6bd3f31adea247ce3ecaa1b4d4336c152afd70c7745f570b8e36288ceb170142007adf8cee69b1fb65f6c572a11fd265e79b7f1b7816d39a9baa2882f3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25523.exe

Filesize
468KB

MD5
b0cec62783f000d7431822c1c8f76c73

SHA1
7c80f36fc923a1b2a5798eacebda985da741e0b0

SHA256
640f0e2359f4d173e01a3bf70b467a0cf2d8830ed2ac4e08edf01e1bf61e4455

SHA512
6822455e6b09ff772527a302dfad506419c910f90cc17bcbccc64658106366656840938b7cbea8a8df5ee716a301772ffa210c46080d8bcf048369dec23c3d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe

Filesize
468KB

MD5
eccc25c1b3128c13e02b0db330562836

SHA1
763df517919fadc76526c46ce5a77518143d72c4

SHA256
bf43b7bd5729174e8057b356e17540161f0786d8e0cdfada5cddbcecbf64ab88

SHA512
0612bad0d18a567dcaecafd591426501dbe12cda265f1526ef352cbd9c2c491f64bacdd600a35ecd630f6ee43562f7a729dcf1c1680ac169f39e38c1e111e3ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26356.exe

Filesize
468KB

MD5
7a2942c6a0eeda9b6495e108fcc9cf6c

SHA1
363cb62ef055a2a438c7a46b7d4b86473c50694d

SHA256
536f3010d13acb34b71de341a9de64247618c6ee29dafb9969b5525c0640ed58

SHA512
c18eee27970ca0330302335fcc573cba0720d77b242f9c52091cbe8e15d28a4b1896a865050e3cbd42b90c3ff7e78a288a0ea953b5ebce6c83363b2211d565d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe

Filesize
468KB

MD5
ff05658fa8452b45ba583e6ebb016924

SHA1
6d83bf747742a4e62c519741129be2535ec2437b

SHA256
8cf0293fa9df881a80a498fb69618fbd5118d0684ec2d5986e21f1cde30f5cb3

SHA512
fa9a95d5a1197438e2846040ce7e1953dc345d0612b585d9783104da0ca817670cd9a684240214daf119abcd4e4214555d9dfa3f386dbd82a80038fae3cb33f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31878.exe

Filesize
468KB

MD5
c143961deffe8c5dddac771bb27869d3

SHA1
8ab9d91898fe961efb6396a15812c23ed2dcd78c

SHA256
c8878cdb6044d4f1b522f4218c763e5736f197a99ea8a59913161cbb9a8fb1d3

SHA512
548e4a1d15e93965d138f5714f35f893c660d1a6d4ea84f0ac537607c54c9f5b8424b4eb0a2438965e723d8e8d60cdf8641e485bbc1a1f49fc522d76995af04e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe

Filesize
468KB

MD5
ba27f1d0291759cbe3aad1fc70e8bb79

SHA1
3b3381054bb74a45a324499178b5731ec65f3cbd

SHA256
fd4ce44aa353ea515b2cb8e164fe39856035f9366d63b28a25becd14c465d71f

SHA512
bc2bb11acdd81a78b0c79d46925e95c22ba71e07cf5a4234390446e458c5f035ee7f0fc9519772aca524b938f9f58d4815c6c5e8fbb2e8c41e549ce1730c942e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33705.exe

Filesize
468KB

MD5
711a1c5d7c9ec1f3ee32b859650adbb6

SHA1
6995cc8e13bbb95f2c2b1c1ad263d7d4206471c3

SHA256
255e2b1647564d0dc4bfa6208759356b376d6d756215cf78b02a355490173e00

SHA512
3bbf7df613fce1407a154c022965b40c1f06723d8012be5da59eec0f3ea32af9f6c405822aa0a19db26d00f89fab158f8f8ae9f5d5ac75b580ba757edaa32df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe

Filesize
468KB

MD5
c90352ed0a5f7c8e4b840853e41257a7

SHA1
4d5e3547c3b6fd2a19e55ff3dfa41af1412f47fd

SHA256
34d488aa917d46af0d84dd74e37243de11769204ffbd057b6e29b4137b29dea6

SHA512
830eee1d1328ae20ed6ba71a9424830f1bd18baf2e7164e4f9de2f9abb1ecc9b9127dc7d4a82f288f1f922dd31003433feadcfda0a666855fc75bb5bf0b1d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37427.exe

Filesize
468KB

MD5
0ceda68e32d9c68b6de1ee847d28e807

SHA1
a37dd014c937e2a7932d84a52b536d508da6c753

SHA256
ed4575ec565aa118979e52dc9376039ed6c7f7887b61a5dafea15bdef0df5910

SHA512
41b70511a4c7222e4135aed94cb91ba51bd7f9e53fc6cba8ccd78b6b8070ddf0efdcfac3245ff799921d55b532e44afd26fb5fd503217cd1db6829da3cafc909

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe

Filesize
468KB

MD5
641fea0a51452df8dc5dc023e9de34d9

SHA1
4c710b8ae5ba4dab6b414e45dcfa70ea070263cf

SHA256
5dfeced905d50aa2a12ab80721acc1dd7b567769e4447f520ab3fd64e1990561

SHA512
2aedf1ddc25bbbd0c03a2bf8da0b5c239668fa867f3b1954eea46ae68d4cff92582f0c3dd3b9f80109fe87b3f53878699aeee5e957c2fa11c366db15f9dcd6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37945.exe

Filesize
468KB

MD5
67f42d83e93a66c46ff133fc317bb358

SHA1
da4a30053915f663518ef41d43d6d799c3bba464

SHA256
70e79e5f4a8417b552a34eb1197735b8186515e8a15a4fb76596fdc437a9ee58

SHA512
e64ba6b619205d200e1d56196ad8d16cd3836004c816bf28ccc16a6e4729c8ffef798bbbcae8097d957e7bcba7d27a716bd95ddfc000f365d8794a64d0c32da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe

Filesize
468KB

MD5
d64b00a6fc6f9fa73eafe406fdf58d74

SHA1
d60ec3b87c239a8a5ba59ed91b6e7805946630d1

SHA256
d8bfe1b5aa8fe0d412ebd86f3e255bb30cc4466e18a0af7b9e4fc8db1e958277

SHA512
04b702b2570bdae57b6c64b9a5a76d02cdb067394079b29ef6cb68e3ad07753e7d020e34023629adb95397ea7ad0adcbcb86dd982751282eb048a029adae002c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe

Filesize
468KB

MD5
7883eff7955654d412945604cd92f5fc

SHA1
02fb1bb6e606625b25860aee079506589e8ecaed

SHA256
cb5d34de05b774f20719c074969ab56e419448ce2a5e01ad073b343225b6f368

SHA512
fdc15ad5b7976eedb5f2f72aeee44c5cb7cf883498347614c511c3186cc4113a7eb935e97ab0f7b6d3330da5d496d474b8450a652f7d69f8165cb5672052bdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe

Filesize
468KB

MD5
292a29d431b147096887ade1c061d763

SHA1
426ebe9e72ec50d889c5fb689ef6c60f697075dc

SHA256
373864b3c18ce7f9812480e84ed133713acb7d200592fd1db9da33f719c730c8

SHA512
11805d5294eded0cd4f165060443216c9cd84860633f9a05b0692460905f65cfd85f0e52b109400322a25782dd39964e753082582963fd4f18dfe5b7a3860caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe

Filesize
468KB

MD5
7e9de31dd400e4cff85cef09c94d0551

SHA1
e8d9ac09b9687af1b9e233dbc92cdd47e4c43e21

SHA256
cca9d0f3ee4d4640c87ad22edb4db6eb93ffed729fcf08fd6e9e6ca892ab5c77

SHA512
5522d3a39391ff1deb98689b23a759900d779243814b5190caddb8e43f5b94b2a863bd52cad167a55d5a1446255714e37aa2e5b183c8c62091d9719658bca54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4562.exe

Filesize
468KB

MD5
582ac998a169fa73af83abb6d2b2a905

SHA1
503528a14410fe1c18d73bd0c74f6054f6631bdb

SHA256
e369fedc89afc28926c4ea4c9fffe83ccee99a42eaf425a279d54bb1d797e2a1

SHA512
aebbf88d958fdfbe42ab5beb63a2a7106664a8ec1a975e5eca940558ea419b94c5d640a0733e4bf0ecebcf8def9e6a7361ec96d445bc21e5c4e66d60bf86f9c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4674.exe

Filesize
468KB

MD5
14fe5d45b764737d42dbb6c207ad5aac

SHA1
2b53a9fee0f50fe5f763d0bd4c0a60a00a87440c

SHA256
3f189f39b6c3a6b0a52fcb3d6fad220dfdf7c7b54a7051bf81ff7ca15e982faa

SHA512
43073a1149d32ee672301344bed863f03d0f230b82c26bc20a74f578698f39c19710213137a62d9ea798141ec1df287ff90776510c2ec98448c7a461b3f6a6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe

Filesize
468KB

MD5
7401086981bd249ef7a2f00398b2a642

SHA1
e1a114cd4b49f1e8226473da646cb6c6d561733a

SHA256
5f15638feb48fc24e5239fa7c19f42701e1b9d0cd3db9a40bdab3187776b0081

SHA512
c938dc23eb7fc7d517ae420e831f528ed1ff79de885e1b6f58ee9ca09d2455d6e4389b52a06c44deaff9c8f01e806358c2d2542e817148557ce76e84da2285d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe

Filesize
468KB

MD5
5936c086b4026ad5d84a047016cc882e

SHA1
45b4db408ec8bfa1df005cb5ba227abe33d50c39

SHA256
06485be61c12fa9383a9a69699cdd30b011f71f8894d10a1424c8af0e0bc054e

SHA512
58d070abbda5cfede71575cff8869f8197d6ec5433f3a25e844e8f0efe9091c0e551ebe73c62cfbc1819b7e027cdc7de0a5e456c878905b14ed562f7bbcfb133

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe

Filesize
468KB

MD5
a9e835e0f6d750eb8421d8317ff28dcf

SHA1
12908235804d872a860ea656fd3b550d71ebc179

SHA256
35b308da1e15237c130218a43838d756eb2e674fd8349d88aa6fdd1d7c3973a1

SHA512
93046fccb978d7df69ee8aa07201f2971c12ebe9f634643c438a77f03254683646e2bfbbd8f81cef58733fd688cc64c4b2cf84800b29236efd9d2769c74b5daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe

Filesize
468KB

MD5
dc129e9ba66018000ecbe91238fdcd3e

SHA1
deee51ebe64d7028f7da731b90aeeb3d2065744d

SHA256
b868e92cc6c93058241422e8d0d45223a51d9678fd09288a1ec81830efda3a91

SHA512
ebc729fda597b1289ca0f9e16b1725f4411bc796c0aebd3b6e5ebb87e10fbbf687a1f779652434357438915d6cefcdc973224a092b776fac6e932dbc8f6f1914

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe

Filesize
468KB

MD5
84f02fa006d33681ecc047177c13a02a

SHA1
493557b0c9c791da7b9794bf3c61c729f2aa5567

SHA256
09e004ac9bff378692218a17685552d9f1a24f3df18837a8a03f985a2ecaa867

SHA512
a67729a872aff84624a6c7be3dfa3d9a50bc5179560543f16e9c4ee65612c55d77946ab2c8c350cfc39b3bb8cb0d19ae648e0ef8b42b72dd8d96d82ecad2e89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe

Filesize
468KB

MD5
07ec68d14e14b4017f94b16c9586894b

SHA1
7d61b5b816f6353d8df5a458e3c7ed41a40378cf

SHA256
054ad442070a09d520bc0568d7dd3b6a912ee75f42f058f8e28b6d83fc53da13

SHA512
1b207fbeeb53eb45eb1e3748e6763e77a221f87d6b57d46641ffef8a5e01c6395465bd6463902b8fe01e99426b2d3f9e0ccb5e044b3538a80142244d7593e256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58691.exe

Filesize
468KB

MD5
b7193a94ba24a0aa01f220e31b3f801c

SHA1
48b4c930ebfa8ab85b0f49e94630ed9e658cb2a9

SHA256
b1594c549e874a433735bf0ab1d69b83b0b8b0fb1bb64b27c94ef61c76c89476

SHA512
4f680f3ae40e94b01a045f32354a0cc797f75f140997eb7d9d6c132a3672e3f4583d77b265b513d95f516ed9304b72cffadf7ca75cef22962de60aa656166c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59264.exe

Filesize
468KB

MD5
765aaf2220ae506149e2cb751f5a7db1

SHA1
3c919af201047b34e47eb775c2f110b3f4513068

SHA256
e86373dd006b053792daed9801c711e5d41c058b04c547c72643b5001c748f98

SHA512
d0d1bc5bfe450fa2a36f25c4356ab5505d1e31e683bdd9f99b01c3d703c71f801dee9501e4556c2475dcf4a5d1394c095b1d3abb7d8596c8e827de2891e71625

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6015.exe

Filesize
468KB

MD5
0a6e75c5a9bf93cca8c4cbc04d6e429e

SHA1
e7388661b8806d9bb93009ae8d0beea7e9e8f377

SHA256
eaae58e4b200d88c8f8ef7d395e6946c114e5b276cb8290e35f0878a2ec9fc2e

SHA512
16f0c8c62d59663623a829646511a524bf5d8d67eabbfb6662c83faeed0721c68eca97689e35fab690c3178b7de9df40a6135a9100adb959af67bb0d3656f3ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe

Filesize
468KB

MD5
39dc7ac70547f374f928f87135ebb5e6

SHA1
614ee224304f00077ae73b893c30c8005d35e420

SHA256
45f96f865a25dabfa1c5015172d3e2f47ccce155cc30ca1096117e362fab465e

SHA512
44bb59bc88b7d898e7b71d632380a24150481aba7b78890dc0e5d0d723d8ec95fe48667ba564444543e9e3ab190f6afcaa0d44322dcc6503a7f40d7bf108eaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7650.exe

Filesize
468KB

MD5
f5c6c9daa5900a3fadd129c23ec1c5f9

SHA1
2b71932bd251c30228099a2a53d92d97121f3b7f

SHA256
c85793a323e60b8ca844745149628aad869beac7c335e07a5f25811a513c16eb

SHA512
64db695c05f7bac69c3fff9eb056e95d7cbea9e4089af6b60b2f3ad5dc1c85ef655bbf7da9127f105b437b7ff6cd45d52272246258c7c75b8d18c70ee9c1cf78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe

Filesize
468KB

MD5
3e6c3b15aa7f79a0f87178b77b5c9061

SHA1
f5b8086863887a44655cbdcc50cd3c5110c3bbce

SHA256
ff9b1b2be4664e4e25be20d75ee932922261f7c127a68beef397cee013efd971

SHA512
7375f96dd72e964d2d510c9dabd4a9f299102fabcc71b1e8d10c46ec1703b8b81442c50c9276350a33d9e6be302ecebc03065fb5c2a6b61fdd63c626c7b35085

Download Submit
memory/12372-2602-0x00007FF9E9F70000-0x00007FF9EA165000-memory.dmp

Filesize
2.0MB

Download