121ac5e38005ae79864374cc3a7f4d3c9246fbedd2faaea50b08f8a32c7f019d

Analysis

max time kernel
25s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
Size

468KB
MD5

8bfef7e6bd8ec5bb0b527fed3a4079b0
SHA1

70dc70752c1b132ee96516c5f8d9b4e386d216da
SHA256

121ac5e38005ae79864374cc3a7f4d3c9246fbedd2faaea50b08f8a32c7f019d
SHA512

a0b72aabeff6f528cf8788b84654a99079871d6e7b4e62e9118d3af0fb081d13bbd3abe78b7d70151cb1830afecc4cb1c60af9d76291998ee1c0552f676bd9bf
SSDEEP

3072:1G3KogjSIE5TtbY2HncOcf8KvChaP0pfJVHeTVPDQ7NLO7vgEElp:1G6oAMTtxHcOcfjYqlQ7psvgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4256	Unicorn-26230.exe
2900	Unicorn-26918.exe
4772	Unicorn-23580.exe
3460	Unicorn-6933.exe
3704	Unicorn-59149.exe
3048	Unicorn-7347.exe
1868	Unicorn-58454.exe
3528	Unicorn-58454.exe
804	Unicorn-25517.exe
4796	Unicorn-52516.exe
3912	Unicorn-8412.exe
2528	Unicorn-11765.exe
4836	Unicorn-10924.exe
392	Unicorn-30790.exe
1940	Unicorn-63846.exe
1104	Unicorn-63846.exe
4924	Unicorn-63581.exe
2808	Unicorn-14645.exe
2352	Unicorn-10540.exe
3240	Unicorn-24275.exe
3720	Unicorn-54916.exe
4612	Unicorn-15718.exe
1592	Unicorn-44669.exe
4064	Unicorn-64534.exe
2080	Unicorn-41108.exe
2912	Unicorn-18598.exe
1500	Unicorn-64461.exe
3140	Unicorn-50886.exe
2956	Unicorn-31212.exe
4896	Unicorn-30828.exe
4368	Unicorn-14492.exe
536	Unicorn-50694.exe
2020	Unicorn-18022.exe
1048	Unicorn-41180.exe
3416	Unicorn-32640.exe
3572	Unicorn-32905.exe
1100	Unicorn-25043.exe
3716	Unicorn-60708.exe
1560	Unicorn-61462.exe
2932	Unicorn-41212.exe
5004	Unicorn-61737.exe
3944	Unicorn-6598.exe
3744	Unicorn-45894.exe
4660	Unicorn-46086.exe
2192	Unicorn-26220.exe
1200	Unicorn-29485.exe
2548	Unicorn-34950.exe
3468	Unicorn-4389.exe
2024	Unicorn-37254.exe
4120	Unicorn-33340.exe
3900	Unicorn-36870.exe
4484	Unicorn-51981.exe
4916	Unicorn-55318.exe
4488	Unicorn-7845.exe
3160	Unicorn-34195.exe
4008	Unicorn-23990.exe
708	Unicorn-17859.exe
1060	Unicorn-23414.exe
3408	Unicorn-40326.exe
3032	Unicorn-63101.exe
884	Unicorn-22765.exe
5072	Unicorn-14629.exe
3720	Unicorn-14099.exe
1044	Unicorn-16899.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2896	2900	WerFault.exe	92
1596	2900	WerFault.exe	92
4948	3704	WerFault.exe	99
2780	3704	WerFault.exe	99
1496	392	WerFault.exe	116
1020	3240	WerFault.exe	123
4012	3720	WerFault.exe	120
744	3240	WerFault.exe	123
3032	3720	WerFault.exe	120
884	392	WerFault.exe	116
3924	3416	WerFault.exe	141
3208	536	WerFault.exe	134
4568	2020	WerFault.exe	136
2260	4368	WerFault.exe	135
5912	3744	WerFault.exe	157
6032	1200	WerFault.exe	160
5628	3416	WerFault.exe	141
5960	708	WerFault.exe	172
3112	1044	WerFault.exe	181
4632	6132	WerFault.exe	240
6752	5216	WerFault.exe	206
7816	1500	WerFault.exe	129
7844	3528	WerFault.exe	105
6048	1100	WerFault.exe	143
7820	3140	WerFault.exe	130
7624	1832	WerFault.exe	195
7256	4488	WerFault.exe	168
6488	4120	WerFault.exe	164
8684	6008	WerFault.exe	269
8668	5276	WerFault.exe	285
8816	6196	WerFault.exe	298
8956	2808	WerFault.exe	279
8948	4732	WerFault.exe	276
8940	5464	WerFault.exe	272
8928	5808	WerFault.exe	284
8916	6232	WerFault.exe	299
8872	6660	WerFault.exe	315
8808	1620	WerFault.exe	278
8772	5592	WerFault.exe	282
9140	5240	WerFault.exe	207
5992	5440	WerFault.exe	250
8612	5540	WerFault.exe	219
8680	5004	WerFault.exe	155
5496	5452	WerFault.exe	215
1200	5828	WerFault.exe	225
8768	2092	WerFault.exe	204
1772	5968	WerFault.exe	231
8432	3368	WerFault.exe	241
8700	5608	WerFault.exe	222
6800	7056	WerFault.exe	330
7696	6104	WerFault.exe	238
6068	6848	WerFault.exe	322
7612	3900	WerFault.exe	165
9172	7120	WerFault.exe	334
9224	4980	WerFault.exe	191
9308	2024	WerFault.exe	163
9300	5432	WerFault.exe	249
9576	5100	WerFault.exe	359
9408	6712	WerFault.exe	367
8540	6784	WerFault.exe	348
10028	5232	WerFault.exe	295
9796	6032	WerFault.exe	370
9476	7104	WerFault.exe	360
5580	6356	WerFault.exe	399

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14645.exe

Suspicious use of SetWindowsHookEx 59 IoCs

pid	Process
3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
4256	Unicorn-26230.exe
2900	Unicorn-26918.exe
4772	Unicorn-23580.exe
3460	Unicorn-6933.exe
3048	Unicorn-7347.exe
3704	Unicorn-59149.exe
1868	Unicorn-58454.exe
3528	Unicorn-58454.exe
3912	Unicorn-8412.exe
804	Unicorn-25517.exe
4796	Unicorn-52516.exe
2528	Unicorn-11765.exe
4836	Unicorn-10924.exe
392	Unicorn-30790.exe
1940	Unicorn-63846.exe
1104	Unicorn-63846.exe
2808	Unicorn-14645.exe
3720	Unicorn-54916.exe
3240	Unicorn-24275.exe
4924	Unicorn-63581.exe
2352	Unicorn-10540.exe
4612	Unicorn-15718.exe
1592	Unicorn-44669.exe
4064	Unicorn-64534.exe
2080	Unicorn-41108.exe
2912	Unicorn-18598.exe
1500	Unicorn-64461.exe
3140	Unicorn-50886.exe
2956	Unicorn-31212.exe
3572	Unicorn-32905.exe
2020	Unicorn-18022.exe
536	Unicorn-50694.exe
4896	Unicorn-30828.exe
4368	Unicorn-14492.exe
3416	Unicorn-32640.exe
1100	Unicorn-25043.exe
1048	Unicorn-41180.exe
3716	Unicorn-60708.exe
1560	Unicorn-61462.exe
2932	Unicorn-41212.exe
5004	Unicorn-61737.exe
3944	Unicorn-6598.exe
3744	Unicorn-45894.exe
2192	Unicorn-26220.exe
4660	Unicorn-46086.exe
1200	Unicorn-29485.exe
2548	Unicorn-34950.exe
2024	Unicorn-37254.exe
3468	Unicorn-4389.exe
4120	Unicorn-33340.exe
3900	Unicorn-36870.exe
4484	Unicorn-51981.exe
4916	Unicorn-55318.exe
4488	Unicorn-7845.exe
3160	Unicorn-34195.exe
4008	Unicorn-23990.exe
3408	Unicorn-40326.exe
708	Unicorn-17859.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4256	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	89
PID 3012 wrote to memory of 4256	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	89
PID 3012 wrote to memory of 4256	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	89
PID 4256 wrote to memory of 2900	4256	Unicorn-26230.exe	92
PID 4256 wrote to memory of 2900	4256	Unicorn-26230.exe	92
PID 4256 wrote to memory of 2900	4256	Unicorn-26230.exe	92
PID 3012 wrote to memory of 4772	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	93
PID 3012 wrote to memory of 4772	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	93
PID 3012 wrote to memory of 4772	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	93
PID 4772 wrote to memory of 3460	4772	Unicorn-23580.exe	95
PID 4772 wrote to memory of 3460	4772	Unicorn-23580.exe	95
PID 4772 wrote to memory of 3460	4772	Unicorn-23580.exe	95
PID 4256 wrote to memory of 3704	4256	Unicorn-26230.exe	99
PID 4256 wrote to memory of 3704	4256	Unicorn-26230.exe	99
PID 4256 wrote to memory of 3704	4256	Unicorn-26230.exe	99
PID 3012 wrote to memory of 3048	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	98
PID 3012 wrote to memory of 3048	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	98
PID 3012 wrote to memory of 3048	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	98
PID 3460 wrote to memory of 3528	3460	Unicorn-6933.exe	105
PID 3460 wrote to memory of 3528	3460	Unicorn-6933.exe	105
PID 3460 wrote to memory of 3528	3460	Unicorn-6933.exe	105
PID 3048 wrote to memory of 1868	3048	Unicorn-7347.exe	106
PID 3048 wrote to memory of 1868	3048	Unicorn-7347.exe	106
PID 3048 wrote to memory of 1868	3048	Unicorn-7347.exe	106
PID 3012 wrote to memory of 804	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	108
PID 3012 wrote to memory of 804	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	108
PID 3012 wrote to memory of 804	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	108
PID 4256 wrote to memory of 4796	4256	Unicorn-26230.exe	109
PID 4256 wrote to memory of 4796	4256	Unicorn-26230.exe	109
PID 4256 wrote to memory of 4796	4256	Unicorn-26230.exe	109
PID 4772 wrote to memory of 3912	4772	Unicorn-23580.exe	110
PID 4772 wrote to memory of 3912	4772	Unicorn-23580.exe	110
PID 4772 wrote to memory of 3912	4772	Unicorn-23580.exe	110
PID 1868 wrote to memory of 2528	1868	Unicorn-58454.exe	114
PID 1868 wrote to memory of 2528	1868	Unicorn-58454.exe	114
PID 1868 wrote to memory of 2528	1868	Unicorn-58454.exe	114
PID 3048 wrote to memory of 4836	3048	Unicorn-7347.exe	115
PID 3048 wrote to memory of 4836	3048	Unicorn-7347.exe	115
PID 3048 wrote to memory of 4836	3048	Unicorn-7347.exe	115
PID 4796 wrote to memory of 392	4796	Unicorn-52516.exe	116
PID 4796 wrote to memory of 392	4796	Unicorn-52516.exe	116
PID 4796 wrote to memory of 392	4796	Unicorn-52516.exe	116
PID 3528 wrote to memory of 1940	3528	Unicorn-58454.exe	117
PID 3528 wrote to memory of 1940	3528	Unicorn-58454.exe	117
PID 3912 wrote to memory of 1104	3912	Unicorn-8412.exe	118
PID 3528 wrote to memory of 1940	3528	Unicorn-58454.exe	117
PID 3912 wrote to memory of 1104	3912	Unicorn-8412.exe	118
PID 3912 wrote to memory of 1104	3912	Unicorn-8412.exe	118
PID 4256 wrote to memory of 4924	4256	Unicorn-26230.exe	119
PID 4256 wrote to memory of 4924	4256	Unicorn-26230.exe	119
PID 4256 wrote to memory of 4924	4256	Unicorn-26230.exe	119
PID 3012 wrote to memory of 3720	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	120
PID 3012 wrote to memory of 3720	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	120
PID 3012 wrote to memory of 3720	3012	8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe	120
PID 804 wrote to memory of 2808	804	Unicorn-25517.exe	121
PID 804 wrote to memory of 2808	804	Unicorn-25517.exe	121
PID 804 wrote to memory of 2808	804	Unicorn-25517.exe	121
PID 3460 wrote to memory of 2352	3460	Unicorn-6933.exe	122
PID 3460 wrote to memory of 2352	3460	Unicorn-6933.exe	122
PID 3460 wrote to memory of 2352	3460	Unicorn-6933.exe	122
PID 4772 wrote to memory of 3240	4772	Unicorn-23580.exe	123
PID 4772 wrote to memory of 3240	4772	Unicorn-23580.exe	123
PID 4772 wrote to memory of 3240	4772	Unicorn-23580.exe	123
PID 2528 wrote to memory of 4612	2528	Unicorn-11765.exe	124

C:\Users\Admin\AppData\Local\Temp\8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe
"C:\Users\Admin\AppData\Local\Temp\8bfef7e6bd8ec5bb0b527fed3a4079b0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 720
      4⤵
      Program crash
      PID:2896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 720
      4⤵
      Program crash
      PID:1596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 728
      4⤵
      Program crash
      PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 728
      4⤵
      Program crash
      PID:2780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30790.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 724
        5⤵
        Program crash
        
        PID:1496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 724
        5⤵
        Program crash
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62838.exe
        7⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        8⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 636
        9⤵
        Program crash
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65506.exe
        9⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13384.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
        9⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63202.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
        8⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23019.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43515.exe
        9⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        10⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16043.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12641.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60754.exe
        7⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57627.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        7⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20417.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57979.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23611.exe
        9⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51227.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        7⤵
        
        PID:9660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 724
        6⤵
        Program crash
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3372.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50299.exe
        6⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
        8⤵
        
        PID:14188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        7⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8154.exe
        6⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63851.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42993.exe
        7⤵
        
        PID:12248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 656
        6⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        5⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        6⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        5⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10234.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20284.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40283.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48379.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5009.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26411.exe
        6⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41947.exe
        7⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60249.exe
        5⤵
        
        PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26603.exe
        6⤵
        
        PID:9264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7656 -s 656
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
      4⤵
      PID:8564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8564 -s 640
        5⤵
        
        PID:13440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8564 -s 640
        5⤵
        
        PID:13904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38395.exe
      4⤵
      PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        5⤵
        
        PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
      4⤵
      PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
      4⤵
      PID:15032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 636
        5⤵
        Program crash
        
        PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25043.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24523.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
        6⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 636
        7⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 636
        7⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9850.exe
        7⤵
        
        PID:12788
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6472 -s 668
        6⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        5⤵
        
        PID:7956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 728
        6⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12600.exe
        5⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43675.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:14544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 636
      4⤵
      Program crash
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63101.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 608
        6⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6872 -s 736
        5⤵
        
        PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31096.exe
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
      4⤵
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
      4⤵
      PID:13384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24261.exe
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
    3⤵
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60043.exe
      4⤵
      PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61355.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27249.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34216.exe
      4⤵
      PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62250.exe
    3⤵
    PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33675.exe
      4⤵
      PID:12316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40065.exe
    3⤵
    PID:12080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
    3⤵
    PID:8104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13548.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        9⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2250.exe
        10⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720
        10⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 720
        10⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25825.exe
        9⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 660
        9⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 712
        8⤵
        Program crash
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51981.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52084.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
        8⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 640
        9⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 640
        9⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52274.exe
        8⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        9⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31681.exe
        9⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10888.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44697.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10280.exe
        7⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10032 -s 640
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        7⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41259.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        9⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30129.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        8⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 656
        7⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27912.exe
        6⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8184 -s 724
        7⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        6⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63627.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        6⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15750.exe
        8⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16843.exe
        9⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6490.exe
        10⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10074.exe
        11⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        12⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32449.exe
        11⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46137.exe
        11⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41153.exe
        10⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        9⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42491.exe
        10⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        10⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
        10⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 712
        9⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47154.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51787.exe
        9⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7457.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18840.exe
        9⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18360.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        9⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        8⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38673.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        8⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38507.exe
        9⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50843.exe
        10⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        10⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        10⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        9⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        9⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41713.exe
        8⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 748
        8⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 724
        7⤵
        Program crash
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48998.exe
        7⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 636
        8⤵
        Program crash
        
        PID:8948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 656
        7⤵
        Program crash
        
        PID:8612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 652
        6⤵
        Program crash
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17859.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 724
        6⤵
        Program crash
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43357.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        6⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        7⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 644
        8⤵
        Program crash
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        8⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15992.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56610.exe
        7⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9912.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33410.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        6⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 556
        5⤵
        Program crash
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8245.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        9⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 636
        10⤵
        Program crash
        
        PID:9408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 720
        8⤵
        Program crash
        
        PID:8700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 756
        7⤵
        Program crash
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43771.exe
        9⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7752 -s 636
        10⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23089.exe
        9⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        10⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        9⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        9⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21409.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        9⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46939.exe
        10⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        10⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57001.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
        9⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60322.exe
        8⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        8⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 736
        7⤵
        Program crash
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19160.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        7⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54843.exe
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29249.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        9⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 720
        7⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2753.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65314.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        6⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26379.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64306.exe
        7⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48091.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        5⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        6⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 636
        7⤵
        Program crash
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12506.exe
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        7⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61458.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        6⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3592.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59131.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        6⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29090.exe
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9800.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11194.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        5⤵
        
        PID:7056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 724
        6⤵
        Program crash
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18321.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        6⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        7⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31633.exe
        7⤵
        
        PID:14476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8056 -s 636
        6⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40553.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27339.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
        6⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26849.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exe
        5⤵
        
        PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22765.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10933.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        6⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6196 -s 644
        7⤵
        Program crash
        
        PID:8816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 668
        6⤵
        Program crash
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23681.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        6⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        8⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46322.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
        6⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        5⤵
        
        PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10769.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43385.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        5⤵
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        6⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 636
        7⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
        6⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        7⤵
        
        PID:2616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 624
        6⤵
        
        PID:8876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 724
        5⤵
        Program crash
        
        PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
      4⤵
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        5⤵
        
        PID:7888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 668
        5⤵
        
        PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22874.exe
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2249.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
      4⤵
      PID:14456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 636
        6⤵
        Program crash
        
        PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 636
        5⤵
        Program crash
        
        PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16899.exe
      4⤵
      Executes dropped EXE
      PID:1044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 716
        5⤵
        Program crash
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36429.exe
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52219.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13281.exe
        5⤵
        
        PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52619.exe
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
      4⤵
      PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 640
      4⤵
      Program crash
      PID:1020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 640
      4⤵
      Program crash
      PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 636
      4⤵
      Program crash
      PID:3924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 672
      4⤵
      Program crash
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14099.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
        6⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55186.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        8⤵
        
        PID:2532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 624
        6⤵
        Program crash
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61186.exe
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        5⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30322.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        5⤵
        
        PID:1188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
    3⤵
    PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        5⤵
        
        PID:3976
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 728
        6⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40575.exe
        5⤵
        
        PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
      4⤵
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
      4⤵
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51291.exe
    3⤵
    PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44731.exe
      4⤵
      PID:7576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 644
        5⤵
        
        PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
      4⤵
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
    3⤵
    PID:8548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 656
      4⤵
      PID:7864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
    3⤵
    PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
      4⤵
      PID:7944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32401.exe
    3⤵
    PID:8084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49978.exe
    3⤵
    PID:14896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        7⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 636
        8⤵
        Program crash
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
        8⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 632
        9⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41890.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13809.exe
        8⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17723.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34843.exe
        7⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8940.exe
        6⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38630.exe
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
        9⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25131.exe
        10⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        11⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40961.exe
        10⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13690.exe
        11⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        10⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52002.exe
        10⤵
        
        PID:14372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 544
        8⤵
        Program crash
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27819.exe
        8⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 616
        8⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19825.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        8⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        6⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        7⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 640
        8⤵
        Program crash
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49291.exe
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38169.exe
        7⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41115.exe
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        7⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40802.exe
        6⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 724
        7⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23048.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        6⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        6⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 636
        7⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31714.exe
        6⤵
        
        PID:9752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 752
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8451.exe
        5⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
        6⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        7⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 728
        8⤵
        Program crash
        
        PID:8916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 752
        7⤵
        Program crash
        
        PID:8432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 684
        6⤵
        Program crash
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15100.exe
        5⤵
        
        PID:5808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 648
        6⤵
        Program crash
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17912.exe
        5⤵
        
        PID:7200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 636
        6⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40721.exe
        5⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18299.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        6⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19690.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61737.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        6⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        7⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 668
        7⤵
        Program crash
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        6⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        7⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 636
        8⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10282.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        8⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 736
        7⤵
        
        PID:14316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 720
        6⤵
        Program crash
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        5⤵
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37225.exe
        5⤵
        
        PID:7120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 636
        6⤵
        Program crash
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12049.exe
        5⤵
        
        PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48790.exe
        5⤵
        
        PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
      4⤵
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47979.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
        9⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        9⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        9⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32129.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        7⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42827.exe
        9⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23041.exe
        8⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
        8⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6977.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8346.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14842.exe
        8⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19416.exe
        7⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31563.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        7⤵
        
        PID:14972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 512
        6⤵
        
        PID:9164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 512
        6⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15233.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        6⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54475.exe
        7⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 744
        7⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23073.exe
        6⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38985.exe
        5⤵
        
        PID:6304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 724
        6⤵
        
        PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2456.exe
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58706.exe
        5⤵
        
        PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
      4⤵
      PID:6008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 720
        5⤵
        Program crash
        
        PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49233.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        5⤵
        
        PID:5964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 636
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14641.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6465.exe
        5⤵
        
        PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
      4⤵
      PID:8320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 636
        5⤵
        
        PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4576.exe
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 712
        6⤵
        Program crash
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48614.exe
        6⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 644
        7⤵
        Program crash
        
        PID:8808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 664
        6⤵
        Program crash
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19928.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30683.exe
        6⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6032 -s 636
        7⤵
        Program crash
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15249.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34875.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48018.exe
        6⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        6⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        5⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        6⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38945.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33099.exe
        5⤵
        
        PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48406.exe
        5⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        6⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 728
        7⤵
        Program crash
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        6⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 608
        7⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19480.exe
        6⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23489.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11082.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42763.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40731.exe
        9⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        8⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        7⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43633.exe
        6⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        7⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55593.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
        5⤵
        
        PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40873.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-81.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-81.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43090.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29937.exe
        6⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        5⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45787.exe
        6⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46185.exe
        5⤵
        
        PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36376.exe
      4⤵
      PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        5⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25147.exe
        6⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13793.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
        5⤵
        
        PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11713.exe
      4⤵
      PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7658.exe
        5⤵
        
        PID:13808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
      4⤵
      PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
      4⤵
      PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46086.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62557.exe
      4⤵
      PID:5216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 628
        5⤵
        Program crash
        
        PID:6752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 632
      4⤵
      Program crash
      PID:6032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8147.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63606.exe
      4⤵
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45291.exe
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        6⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        7⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        6⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11025.exe
        5⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        5⤵
        
        PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
      4⤵
      PID:5528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 608
        5⤵
        
        PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8744.exe
      4⤵
      PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12257.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
      4⤵
      PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
    3⤵
    PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
      4⤵
      PID:6568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6568 -s 648
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
      4⤵
      PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35275.exe
        5⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40539.exe
        6⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
    3⤵
    PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      4⤵
      PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        5⤵
        
        PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13025.exe
      4⤵
      PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
    3⤵
    PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
    3⤵
    PID:12792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
    3⤵
    PID:3500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23430.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51067.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4625.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40985.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        7⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        6⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62665.exe
        7⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9249.exe
        6⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        7⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33976.exe
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        6⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        6⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 700
        7⤵
        Program crash
        
        PID:8772
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 632
        6⤵
        Program crash
        
        PID:5496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 744
        5⤵
        Program crash
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33340.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
        5⤵
        
        PID:5496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 752
        5⤵
        Program crash
        
        PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9013.exe
        5⤵
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22529.exe
        5⤵
        
        PID:6660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 636
        6⤵
        Program crash
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        5⤵
        
        PID:7780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 636
        6⤵
        
        PID:10532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 636
        6⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        5⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53083.exe
        6⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55481.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16033.exe
        5⤵
        
        PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35689.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1745.exe
        5⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35211.exe
        6⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45426.exe
      4⤵
      PID:8124
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 640
        5⤵
        
        PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-584.exe
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17441.exe
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26955.exe
      4⤵
      PID:14536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
    3⤵
    PID:392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18630.exe
      4⤵
      PID:6132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 636
        5⤵
        Program crash
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
      4⤵
      PID:6848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6848 -s 632
        5⤵
        Program crash
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62633.exe
      4⤵
      PID:7232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7232 -s 724
        5⤵
        
        PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36088.exe
      4⤵
      PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17777.exe
      4⤵
      PID:14828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 724
    3⤵
    - Program crash
    PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 724
    3⤵
    - Program crash
    PID:3032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46827.exe
        6⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 644
        7⤵
        Program crash
        
        PID:9576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14629.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6763.exe
  2⤵
  PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41510.exe
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62411.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10650.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        7⤵
        
        PID:13392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 668
        5⤵
        
        PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1809.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58153.exe
      4⤵
      PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        5⤵
        
        PID:15208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 664
    3⤵
    - Program crash
    PID:5992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
  2⤵
  PID:6992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5777.exe
    3⤵
    PID:9596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43673.exe
    3⤵
    PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24706.exe
    3⤵
    PID:13668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37697.exe
  2⤵
  PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19499.exe
    3⤵
    PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58971.exe
      4⤵
      PID:14132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3369.exe
  2⤵
  PID:1040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
  2⤵
  PID:14068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
  2⤵
  PID:14920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2900 -ip 2900
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2900 -ip 2900
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3704 -ip 3704
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3704 -ip 3704
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 392 -ip 392
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3720 -ip 3720
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3240 -ip 3240
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3720 -ip 3720
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3240 -ip 3240
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 392 -ip 392
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3416 -ip 3416
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4368 -ip 4368
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2020 -ip 2020
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 536 -ip 536
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1104 -ip 1104
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4924 -ip 4924
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4924 -ip 4924
1⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1104 -ip 1104
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3744 -ip 3744
1⤵
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1200 -ip 1200
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2548 -ip 2548
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3744 -ip 3744
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2808 -ip 2808
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1200 -ip 1200
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2548 -ip 2548
1⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3416 -ip 3416
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2808 -ip 2808
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2020 -ip 2020
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 708 -ip 708
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4008 -ip 4008
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5072 -ip 5072
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1044 -ip 1044
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1060 -ip 1060
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4804 -ip 4804
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3488 -ip 3488
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 536 -ip 536
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5072 -ip 5072
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4368 -ip 4368
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4008 -ip 4008
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4804 -ip 4804
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1044 -ip 1044
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1060 -ip 1060
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3488 -ip 3488
1⤵
PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5584 -ip 5584
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5496 -ip 5496
1⤵
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5340 -ip 5340
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4788 -ip 4788
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5324 -ip 5324
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5480 -ip 5480
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5216 -ip 5216
1⤵
PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4492 -ip 4492
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 880 -ip 880
1⤵
PID:6324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 804 -ip 804
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5516 -ip 5516
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5168 -ip 5168
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5860 -ip 5860
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6116 -ip 6116
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6132 -ip 6132
1⤵
PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5196 -ip 5196
1⤵
PID:6208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5424 -ip 5424
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5296 -ip 5296
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5496 -ip 5496
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5324 -ip 5324
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5584 -ip 5584
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5480 -ip 5480
1⤵
PID:6796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1500 -ip 1500
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4980 -ip 4980
1⤵
PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 5216 -ip 5216
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5340 -ip 5340
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4492 -ip 4492
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 880 -ip 880
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 4788 -ip 4788
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 3944 -ip 3944
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 804 -ip 804
1⤵
PID:6316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1100 -ip 1100
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 2912 -ip 2912
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 1832 -ip 1832
1⤵
PID:6160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3160 -ip 3160
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4488 -ip 4488
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2080 -ip 2080
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3720 -ip 3720
1⤵
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 3140 -ip 3140
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4484 -ip 4484
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 4660 -ip 4660
1⤵
PID:6760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 4120 -ip 4120
1⤵
PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 3528 -ip 3528
1⤵
PID:7588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5516 -ip 5516
1⤵
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5168 -ip 5168
1⤵
PID:7644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5860 -ip 5860
1⤵
PID:7668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 5424 -ip 5424
1⤵
PID:7692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 5276 -ip 5276
1⤵
PID:7708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 2740 -ip 2740
1⤵
PID:7232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 6008 -ip 6008
1⤵
PID:7480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 5692 -ip 5692
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5296 -ip 5296
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 5592 -ip 5592
1⤵
PID:8224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 1620 -ip 1620
1⤵
PID:8388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6232 -ip 6232
1⤵
PID:8480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6196 -ip 6196
1⤵
PID:8508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5808 -ip 5808
1⤵
PID:8592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5464 -ip 5464
1⤵
PID:8700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4732 -ip 4732
1⤵
PID:9048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 2808 -ip 2808
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 6660 -ip 6660
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6116 -ip 6116
1⤵
PID:8416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 5196 -ip 5196
1⤵
PID:8452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 5240 -ip 5240
1⤵
PID:8556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4980 -ip 4980
1⤵
PID:8532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3944 -ip 3944
1⤵
PID:8656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2912 -ip 2912
1⤵
PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3368 -ip 3368
1⤵
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3160 -ip 3160
1⤵
PID:9156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5968 -ip 5968
1⤵
PID:9184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2092 -ip 2092
1⤵
PID:9172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5828 -ip 5828
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5452 -ip 5452
1⤵
PID:8592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5004 -ip 5004
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5540 -ip 5540
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5440 -ip 5440
1⤵
PID:8624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 3720 -ip 3720
1⤵
PID:8216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2080 -ip 2080
1⤵
PID:9136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 4484 -ip 4484
1⤵
PID:8268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4660 -ip 4660
1⤵
PID:9340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 708 -ip 708
1⤵
PID:9408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3900 -ip 3900
1⤵
PID:9472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6104 -ip 6104
1⤵
PID:9476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 5608 -ip 5608
1⤵
PID:9488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 7056 -ip 7056
1⤵
PID:9552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 7120 -ip 7120
1⤵
PID:9616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 6848 -ip 6848
1⤵
PID:9680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 5432 -ip 5432
1⤵
PID:9792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1212 -p 2024 -ip 2024
1⤵
PID:10048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 2740 -ip 2740
1⤵
PID:10156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1232 -p 2664 -ip 2664
1⤵
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7104 -ip 7104
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 6784 -ip 6784
1⤵
PID:9348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6032 -ip 6032
1⤵
PID:7748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5232 -ip 5232
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6712 -ip 6712
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 5692 -ip 5692
1⤵
PID:10060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5100 -ip 5100
1⤵
PID:10024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6680 -ip 6680
1⤵
PID:10528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 5748 -ip 5748
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4692 -ip 4692
1⤵
PID:10700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5528 -ip 5528
1⤵
PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 7808 -ip 7808
1⤵
PID:11432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4708 -ip 4708
1⤵
PID:11724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 3968 -ip 3968
1⤵
PID:11904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 7200 -ip 7200
1⤵
PID:11996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 5344 -ip 5344
1⤵
PID:12004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6356 -ip 6356
1⤵
PID:12012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6788 -ip 6788
1⤵
PID:12064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6568 -ip 6568
1⤵
PID:12096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 7008 -ip 7008
1⤵
PID:12140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3976 -ip 3976
1⤵
PID:12148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 6804 -ip 6804
1⤵
PID:11084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 6732 -ip 6732
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6872 -ip 6872
1⤵
PID:11356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6252 -ip 6252
1⤵
PID:12468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 2900 -ip 2900
1⤵
PID:12552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 7780 -ip 7780
1⤵
PID:12848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 6148 -ip 6148
1⤵
PID:13264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 7224 -ip 7224
1⤵
PID:11628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1372 -p 7992 -ip 7992
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1324 -p 7792 -ip 7792
1⤵
PID:12276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 8136 -ip 8136
1⤵
PID:8364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 7964 -ip 7964
1⤵
PID:8672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 1768 -ip 1768
1⤵
PID:9180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 8032 -ip 8032
1⤵
PID:8388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 8096 -ip 8096
1⤵
PID:8832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 7032 -ip 7032
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 7840 -ip 7840
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1504 -p 7660 -ip 7660
1⤵
PID:12628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1532 -p 8080 -ip 8080
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7576 -ip 7576
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1528 -p 8124 -ip 8124
1⤵
PID:12844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1556 -p 7956 -ip 7956
1⤵
PID:12472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1568 -p 8184 -ip 8184
1⤵
PID:12932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7232 -ip 7232
1⤵
PID:12984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 8744 -ip 8744
1⤵
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 5404 -ip 5404
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6680 -ip 6680
1⤵
PID:7228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1492 -p 4692 -ip 4692
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1520 -p 5748 -ip 5748
1⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1560 -p 7980 -ip 7980
1⤵
PID:10760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1404 -p 8116 -ip 8116
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1396 -p 7592 -ip 7592
1⤵
PID:12644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6132 -ip 6132
1⤵
PID:11804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1580 -p 8164 -ip 8164
1⤵
PID:12932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1612 -p 8648 -ip 8648
1⤵
PID:7328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1628 -p 1100 -ip 1100
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7888 -ip 7888
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1508 -p 7860 -ip 7860
1⤵
PID:12044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 7360 -ip 7360
1⤵
PID:11768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1464 -p 7764 -ip 7764
1⤵
PID:10988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 7832 -ip 7832
1⤵
PID:12780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1504 -p 7676 -ip 7676
1⤵
PID:13044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 5780 -ip 5780
1⤵
PID:10724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 8548 -ip 8548
1⤵
PID:9688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1616 -p 8072 -ip 8072
1⤵
PID:12856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8140 -ip 8140
1⤵
PID:13328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 7752 -ip 7752
1⤵
PID:13536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 7072 -ip 7072
1⤵
PID:13796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1492 -p 5416 -ip 5416
1⤵
PID:13804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 9276 -ip 9276
1⤵
PID:13812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 9328 -ip 9328
1⤵
PID:13820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 6744 -ip 6744
1⤵
PID:13944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 8564 -ip 8564
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1580 -p 6628 -ip 6628
1⤵
PID:9088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 1232 -ip 1232
1⤵
PID:14232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 5964 -ip 5964
1⤵
PID:13800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8320 -ip 8320
1⤵
PID:9676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5512 -ip 5512
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6304 -ip 6304
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 6412 -ip 6412
1⤵
PID:14304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1340 -p 1596 -ip 1596
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1404 -p 2932 -ip 2932
1⤵
PID:8580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 3140 -ip 3140
1⤵
PID:6900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 6168 -ip 6168
1⤵
PID:15220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 1500 -ip 1500
1⤵
PID:14504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6472 -ip 6472
1⤵
PID:14616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 8056 -ip 8056
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1404 -p 8012 -ip 8012
1⤵
PID:9224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1296 -p 4488 -ip 4488
1⤵
PID:14352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 5276 -ip 5276
1⤵
PID:14804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 6008 -ip 6008
1⤵
PID:14868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1504 -p 6732 -ip 6732
1⤵
PID:14944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 7200 -ip 7200
1⤵
PID:14952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1664 -p 6148 -ip 6148
1⤵
PID:11912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1688 -p 7160 -ip 7160
1⤵
PID:15204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1716 -p 8252 -ip 8252
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 10244 -ip 10244
1⤵
PID:14688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5556 -ip 5556
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7912 -ip 7912
1⤵
PID:8580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1668 -p 3968 -ip 3968
1⤵
PID:15224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1676 -p 5344 -ip 5344
1⤵
PID:14484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1352 -p 6216 -ip 6216
1⤵
PID:14380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4708 -ip 4708
1⤵
PID:14396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 6252 -ip 6252
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1704 -p 5852 -ip 5852
1⤵
PID:8784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 7788 -ip 7788
1⤵
PID:14860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 8584 -ip 8584
1⤵
PID:15012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 3556 -ip 3556
1⤵
PID:14936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 9752 -ip 9752
1⤵
PID:14960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 7656 -ip 7656
1⤵
PID:14888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1564 -p 7924 -ip 7924
1⤵
PID:13884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3244 -ip 3244
1⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7720 -ip 7720
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1536 -p 8460 -ip 8460
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 9736 -ip 9736
1⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1692 -p 8524 -ip 8524
1⤵
PID:6620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1308 -p 7620 -ip 7620
1⤵
PID:14424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 11028 -ip 11028
1⤵
PID:15060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1732 -p 10232 -ip 10232
1⤵
PID:15216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1760 -p 9596 -ip 9596
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1720 -p 9932 -ip 9932
1⤵
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1816 -p 6196 -ip 6196
1⤵
PID:14932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1792 -p 9872 -ip 9872
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 9884 -ip 9884
1⤵
PID:9024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1832 -p 9592 -ip 9592
1⤵
PID:14504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 10996 -ip 10996
1⤵
PID:15224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6104 -ip 6104
1⤵
PID:14620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 2808 -ip 2808
1⤵
PID:14384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4120 -ip 4120
1⤵
PID:11184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1468 -p 1620 -ip 1620
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1668 -p 1296 -ip 1296
1⤵
PID:14484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1476 -p 4732 -ip 4732
1⤵
PID:13576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 7056 -ip 7056
1⤵
PID:12468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1736 -p 6848 -ip 6848
1⤵
PID:15352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1720 -p 5608 -ip 5608
1⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1800 -p 7120 -ip 7120
1⤵
PID:14824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5540 -ip 5540
1⤵
PID:14832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1764 -p 5808 -ip 5808
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 6232 -ip 6232
1⤵
PID:10924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1356 -p 5592 -ip 5592
1⤵
PID:7916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 208 -ip 208
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 5464 -ip 5464
1⤵
PID:7456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1308 -p 6660 -ip 6660
1⤵
PID:14720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 5004 -ip 5004
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1460 -p 5452 -ip 5452
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1524 -p 5240 -ip 5240
1⤵
PID:6608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5968 -ip 5968
1⤵
PID:15044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2092 -ip 2092
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10540.exe

Filesize
468KB

MD5
698bf108d16a73cba3abd1f41280e5eb

SHA1
b0f22d9996db853ea96ce866d7f405526e4eb08c

SHA256
9f7f30e26224efb11042c74dee2784f7e81b4019455103426fc10536d652cb52

SHA512
b36b1e447e4b8c4ccb2763136c292f37882792372eb054dccddf4581ff9b9a217a729de6e751c93260d5fc4de9dfda4e4439a9a6fd820748cba2d361f8f239d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10924.exe

Filesize
468KB

MD5
0519a330f5b22be181b4e975a26d05fb

SHA1
0a5874c0e57e896e25463b1a19c508d219e92e41

SHA256
3735c88bc8a8a1b6ce65505badef0630602ca63869c8384c94efb005dcef665d

SHA512
c420dbc58b1ee955834cbe0fc08279febe50d7eb53d2865068877c08ca1263e3e15a15735ca8c9280d7cdecda4a0d756655798357be6e8fa3cacdab23a00c1cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe

Filesize
468KB

MD5
ae484c5c4b1acd6a3d9cbf4ab95b12fa

SHA1
ce10395ab36cf8a8425b35dc67189406a1f090d8

SHA256
a32536aacfaefa9daf931ed1ce51b005b56be8eee944b1757af716c435964d04

SHA512
7f8e888b729f421d49c5ffb3c5b95703f970fcbe6d4b8408b77542f707b364be58d7225f8ecbc0d06b24dae37a34c0ae3bef44e2f68599e411676b9a05fdcd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14492.exe

Filesize
468KB

MD5
825323da90e586768286faee9c0f2417

SHA1
23f3caf66e7e76848372dd090073b41bb00df159

SHA256
00d24dd312d914db0e798c375470d31d1776efb0c80752f9609945de6fd6c379

SHA512
0ebbdc3ed6fe157740efbb5357b3067a7727ca5fd0e644b51b4c3fa8cecafb768d5b75dd77158174145c8b7b92760514db1b77a1e3d7fecf11b7e14e317c8e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe

Filesize
468KB

MD5
41df70b749883c3576f4865efa2e2fb2

SHA1
b6b92e7861c82b26f08c0878e8722fca066be9ab

SHA256
f914d36df1c45c8600b53eb3eeca8a0516a8ff65e3e016aaa9e79c44635e470f

SHA512
98746d4ed85e0a67bcd497cf9fea81ee54727ee17eca5f0c19c5101489589fc0fe13da8f0930af6b86c3c683f7cc3ffd38f048c0057ec0a3f96e734abed691dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15718.exe

Filesize
468KB

MD5
d1ae208a8a26ac5738428808c0699c92

SHA1
49a2e0f02952f513cea4ee6f66c0afc5f102d595

SHA256
03bd0f1b7161e62dad851ce26ac9815eeeade8c5ccfabae162f008816bbca88c

SHA512
e328b09d3b9d92d0c56fe5f572155cfa5ef483f09957aa4c70cbd4d2da5091a21a141dd29d47d7a449cdee6e406d96d7a28c4547f647d0c44b3c38f1e606384d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe

Filesize
468KB

MD5
cc1a2ca3a05680d59a41f73d67d46c8a

SHA1
8f650133cb565fdcc48e43776dec0147a921171e

SHA256
eea6db0b3c2b50190ca252a15e3f8d06efc69ccf5848213af0f514be9feb1283

SHA512
881159bce586960f8943e637517e0d566d8621e22a4a80d54936425064957bc60c36ff6da95f2e5fb10a61b89bd5c72a76b808c5ec89d5ab2a1744da065ba7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe

Filesize
468KB

MD5
0df248ee5276916f26b9b09a350d9743

SHA1
b7f1b2af521f4e18ac04248c5d7540d9b2cb9777

SHA256
cce064bcd8423c08f90d09494d1245314a88874178aaece293914c0ca72945e0

SHA512
4fe60a1e74923ed77e09069f64647da50f0a21800cd5dcce79ce0b73b5bb9a30b830a4b3b42275ea4698707fe9b11db96a3f6a9fd3bce18424502f206d8bf2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23580.exe

Filesize
468KB

MD5
f74c4584304bf8e21cbde517450fb43c

SHA1
27cc4ef828fa1fb3e2289529f2e32c8297d9b509

SHA256
d2737635d5afba6c747929088795fbb97ceebf44c4ae28e6d3d7a0785a1506e9

SHA512
6b3e312c01ec584dcc4f5eb0a3c6b5e4b6e45c230e75732cff62b08ca0e3942796aef6436eded814e6c38f545928e4e0fd60de333d009ecf1d3d5eb03e672775

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24275.exe

Filesize
468KB

MD5
9c7cc4351f7a3ab73772a452bc35f1cc

SHA1
3b839b4fabc095e11befb2eff0310866f7456fe4

SHA256
d4a606bbb685f3a8e120ca51da996d3673d20e443f0012b926f6ac9631feeed7

SHA512
703755180b824dc6ec2d15fda605e86e77bf1bdc13d0ea88c33f860d9d31b4c527a9d0c70ff47f257601c687f7aa2551661554882bff77d2da4e104fa0b16009

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe

Filesize
468KB

MD5
d8a840e66b7bdceacd708e2d07891a2f

SHA1
fe23497ccc6426cb83b335e3ffb54e23a0762d5f

SHA256
0e60b6be1b1022fffaa39c7d6f474e1037de1bd9af96db87e1b7093b0b8c0912

SHA512
19a7e1b43e4660ac2b6243256e44cbaad79e6ceb018a1b51503d8d0d2cfc9ee0fadb90e3739272873c7041a41bcf6486d419de2db15223ed031767e1dd85098c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe

Filesize
468KB

MD5
203085f1a676e2dd11f7d65281234c68

SHA1
de8c1cb5c5b68e15e9cbf0d86b63dacb671b0f85

SHA256
b9550f07167b4dee8d092c322091e291f32c7cbe81089c029f0d2994b911f125

SHA512
38845dedac76590dc51aaa175edb99293ff4d2e0400a434f6ac5b917467045f4771b5bb63bc3e5480ca5aa410ff6d6a8211892a5338e2c56a9b5a44a0524c18a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe

Filesize
468KB

MD5
bccb138e3349ee926b0a0d039820a0b3

SHA1
3eaa3d2b4404d317dce8c37a8b0c3878f07fbcd5

SHA256
bd585350f901456ef24ede2739a646527aea0fe2476ccf7f59fe2232939add8f

SHA512
410ec918924a8d7b6bf39d719110439324e8ef2f8b36988602596aafb5dff5881e1926ca43a865bed507aac9cc826cba4679d5783dd5c17fabfe27adeb7faf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27870.exe

Filesize
468KB

MD5
0345a66c534e08459945c5317013e89e

SHA1
bf23d14fa5c03075bfcaefa5a18db3a682db5fb7

SHA256
d3e7e8bd1a353d9aec28011991d7334e0ceca6f914ece8d409c3d4dfce1a61be

SHA512
93c3a06c7caceeeecd1a819eb9ee89c070bd688f317c93fddb2784901f07f5bfd8d559412de2f96a0f3fc56c7d890e54247800eaae95833d7e5c6d1ed4214ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30790.exe

Filesize
468KB

MD5
07cd73b323198f2dee7cdb49328d7123

SHA1
b5063f90cbf860e6904f97ff054b8018b78e16e7

SHA256
3aa371dfbdf0fd027fa97ae39a356bcde21e96fd3bcce19d369a7a874da2df26

SHA512
813dcecfdfbaf1e7c09b92b81755d79bca41cf0937e7ed5e6363b018fc3267f9db778330ae9e4bae8ed4395541a7d86431016a045b1ba447a234c0eb3c5c6fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe

Filesize
468KB

MD5
44cc92e86d4f602c0c87ff92107139db

SHA1
3b49312f38a40d81d1c8d277c69036a9f9e8c1b5

SHA256
452502efae3cfb957482c8d30765045e0ca067cd170433fa27bf441eb9e1b98d

SHA512
957ff86a22f2e4facc2175ee67c88a2f4e3d53f3489e12fa645d92d5c526a9f77abd7c208677ac2543e3eeedee0185fee379b223a9fb87c0bc3773294b297eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe

Filesize
468KB

MD5
ecb034c895028a791f99a0db5c67d898

SHA1
44c89b839f9f48ba45d335230c3d223be12d043c

SHA256
78f615d5d0a6f17124cfbc602abba3e1b091e445ec13560feccfd1c9e22a9d8b

SHA512
f73895e8346fe6455dae8e7f66e6c1c461f7c5394b534afe83164312fe0935750d13e5fedbebd0b34f74c08c59c3aa8d63f72ff38335e09cd2cfad5f32701b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe

Filesize
468KB

MD5
6ba6bd57af40f10984d7f26f14058f7d

SHA1
9681664cd1dcbac670bac705b5fe26f1d7977c95

SHA256
6d8f00297e99f5eb8ee3da4152e23cd3e5521229f9a708e3d00c89a870faacba

SHA512
1af7ac466916f43aa70c15b65f2c27cfd40eae3c906dfccee9d4af9c8c651573deb247e347bcf22df2da99d486d52791ce24069dce813050b40a0f1b087a1646

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44669.exe

Filesize
468KB

MD5
2569fe762fcb177d877e070049c3c014

SHA1
3f8c3de8c00918eee46129804fd4aba8da0f2f4a

SHA256
5045b9013ee9672ea7ac203d6415ba0a06b00e3b3be5ef422f6c2038af75ce40

SHA512
4246ba538c91210eef6ed22eccdb848b23a6b8ffa458f4d9036f20c04c529f37a9be0cf6e0a61eb0432fdc6b49c92cfbca98dd599f7d67b44af9b9953cda372b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe

Filesize
468KB

MD5
e17f5d9805ab619c456966bd3dcc9338

SHA1
cfa2e6c12359c43a677a69ccdf787f94ec98bcf5

SHA256
41cba85261708fbd54ca0b1aa9c7611c5b29833efc98e3e2af63efda7709d243

SHA512
a8c39797013289075455bc3f85f50059912c96b676ddf8dc9e4a8181b09ad501d53dec90fec98507ee69fa15d45956ac0abfa7f2c2c7ca7c50356a0155e17b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe

Filesize
468KB

MD5
28aed55131bace0b753d4a4eb345560b

SHA1
56851e058757233706a077ae18b7995b8b6e768e

SHA256
61c437db1eeda7f974d870ac499489ef3a056cb55e01142dfc86a92fa562f839

SHA512
56b8407460e3858764c919f940d1af1a56d854bc9c35ecb7cae9367871fafb7c84328d92ddcae5a76aeb26a20091de7be2de7e73684468434efd0a062c4fcab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52516.exe

Filesize
468KB

MD5
87ecc7ce900e2ed17e1d71c26c9585b5

SHA1
874891768de9a651cba497d5be8b6758841109f8

SHA256
0a7f6b44f010833ef2acf907146d08cf430ca2b791627306d7a491af936cec0f

SHA512
4980cf489c4dbc1d8430e6b5a4aa48e6b37dc63b5f6679c4f45b05d3f5b63b1c2db1d4e1dd6e246f9669f4b5353aa8f1ab9c18ae6319167a0cd834220b04bacd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe

Filesize
468KB

MD5
38aa13f339bb76dc85ee3a808285fabc

SHA1
e11d82f690c739082e106ec5c300fdc0bff18745

SHA256
4d93bc59c1b141217615a25c905efc19e87a49a3d871f9ab58020aa608cec6f0

SHA512
72edba29b4b6e66b4a8216dd5eba88177d9c8d66f88ed8043fc511291710bbaf35de34ba638d158b5787c9a18bdb96dd7f477a13ef74221c7708ecb97399d21d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54916.exe

Filesize
468KB

MD5
b3bd7733c73336f85177f89769cc7900

SHA1
cefd2dc99d83705766f46ad05a4397fda46954c3

SHA256
5b28f9feecd941b75d976d62bb6a5dac615eecbd439714e178f725bbf4b36156

SHA512
13cfcaf7d71f5c869795a716247b10c21abdab582552d941ef78c9549b6da410f0d10943e92cb4ed85d88103e634466c333c31ab41303c52cc5d81a3acaf9dc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe

Filesize
468KB

MD5
1cfe8d7d39b9880d059567905d4069bf

SHA1
449671a3b911e87e2b30e8ec55468ce782bba80c

SHA256
0b48e74c778b8c6fac88b9ae5dc9c56bcd5e1e3a6c3a5faf8c35dbe07abbe0e4

SHA512
1fe3ac501046c2a1046336fead2e425d56d2987acef634d514acf4896285a95b63fc87aed2e893f3b8f421d5395e150a355f626adde8ed193178098d9cb49a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe

Filesize
468KB

MD5
77c2a5a4b88455e9e2890481499748d9

SHA1
5eb3082377d06c7f2a0a579934f738a039a9db7f

SHA256
bdfd27aaa13d863f2b864d0fe4e9def7df5d7213d766231946756efeb04d76b0

SHA512
4e204b56c911465409683fef987dab029976ebf738c311a191e83711cd8170aade78c245f63b757a255eecde8e571038b5b5362c78bb041bc94acd39688cf670

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe

Filesize
468KB

MD5
09ea8aca3ded8ec05f6d69a1a5cb8bf5

SHA1
710728f3ebb6cad2ab88760cc3438e1ee50ffdd4

SHA256
444f789ac6846553d770235e3b9cb1037c6c0598b666b44bc1841b08e6f4019c

SHA512
229c1590a048b8a49ee5bd1411d8fe28bb5fb73ba4dc6d89a9d1e987690784a758d48a920ce9379553869b72c9501c2760c9ae50236e1fb26ee059192a27390f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe

Filesize
468KB

MD5
bacd52a6b3e78d75d74f592bb7d5730e

SHA1
5e4841df6bec92caa0e34b847370167c57c3ab9e

SHA256
c28e69a3149ddda11163a84d7d684159abd17c06519fe5b3e3596060b939587d

SHA512
99f17e19146fd4835806290b181b4abe5ccd55f4a0aeef6bda1ddd3dc4ed92e52754bde083d57ad05f536a03fccf33cb59a7b4f5a4548d69c127a6ab64506001

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe

Filesize
468KB

MD5
cd201922d18654a548ef29bebb47647f

SHA1
0185acda36ec2d009cbc050b90933102051c862f

SHA256
430eda6f23549bb67f5e0e77912b2893847ea72149475c776aa634b3504f687a

SHA512
0ca1ea18962763c8787aaec64ba0fa90da4ce0cf3dd275ba7c43be6bf6ad895cf1961cb6f997070657a77998445676ab94fbea43c41fd1a4b7e1781eedd91258

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe

Filesize
468KB

MD5
d79e7d9cb3dd6a5eb56c1a61acfb1c56

SHA1
06e8d9385f8fb9783c8b84f27fe25034a610722d

SHA256
28b4cca11c88f8b7b2fa3e0175acc611c11d1d31c1806d04f4fab5d6c0b8ca54

SHA512
ec916c8d2999d7917fbc9d04968aaae341604e39f327e7117bd1050d4b91fd4fe7307846ce9cfc3d767d06236a9cf4704d62a8628bff5f860f0d9735ae407a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6933.exe

Filesize
468KB

MD5
9505c6bb60f2d90640720a213d294bbe

SHA1
b7955fc04485d38b65d2a4991986b622e8b5564d

SHA256
0cad51e8c3af9723e6a6cf651888886954840f778f37e03c1833fbea0d08b3ac

SHA512
6a9c5ad575da60713c56fe39ecbacde82fcdabf971dc75407bdf2819581b29b5db70cf9307d7cb6fa99a702efae6fe5f655912305a3136af483aa01e734bdabe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7347.exe

Filesize
468KB

MD5
2f9b649672dc37f9116b2de0a8444728

SHA1
47d89aa3ecffb6252c92a8f9ba203a39eac4b5e7

SHA256
1baba6f155b4f7120b007ea933f11a4447ffd15a3e29cacf8f32c2b987021649

SHA512
82043b1f1243c320553f53b332527e83696ef4beaee58491584115288f3a8a0318c5b63b52d14531170b35ab8bec066479ba4a2be9e2f08d217b20b15ee44455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8412.exe

Filesize
468KB

MD5
318ea7987c5758059726ed65e12fe300

SHA1
0e5ffe8a4026bf3326e6f1118a4e2e9060fc7518

SHA256
5c59b4583d3fe8a0503703a255bdb83c1228203a8a3630c734d3fd052559d56c

SHA512
9f36c3483113338b1aa18ed37f8b4b364dccb636df483b29c9514ae2dd9429098be1553d9c7677403a8b3a3f6a38d67e084fa5ca8061cf5d9fad1cd767b2f2c8

Download Submit