bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426

Analysis

max time kernel
119s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe
Size

468KB
MD5

2246901b182c449ba3dd8981718e26a0
SHA1

a2fe8575b0205cd8dd4fd61fa22f0d26dc9d07ea
SHA256

bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426
SHA512

53f11bb88ec22dd43b2e7899bebb81e019cc050b2e08dfee897fc4891361ba81f98572beabbb3cd9521a173c4d89a56a35f62c86cc45122758a867db5ac9c84a
SSDEEP

3072:193HogIKIE5TtbYtHz2Ocf8/zCha40pkJVHeTVPyQ65+LC3uEfls:193oDMTtqHqOcfhY10Q6Am3uE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 58 IoCs

pid	Process
4520	Unicorn-7902.exe
2024	Unicorn-53325.exe
444	Unicorn-7653.exe
3808	Unicorn-56543.exe
4148	Unicorn-4005.exe
5060	Unicorn-23871.exe
3940	Unicorn-53620.exe
4220	Unicorn-42335.exe
3440	Unicorn-9662.exe
4160	Unicorn-9662.exe
3580	Unicorn-55334.exe
3012	Unicorn-5557.exe
4928	Unicorn-25158.exe
1264	Unicorn-52157.exe
2472	Unicorn-61388.exe
2460	Unicorn-26447.exe
2356	Unicorn-64076.exe
4232	Unicorn-58138.exe
3432	Unicorn-63692.exe
3648	Unicorn-63884.exe
1272	Unicorn-63884.exe
1312	Unicorn-48617.exe
3424	Unicorn-42487.exe
1052	Unicorn-59971.exe
860	Unicorn-14034.exe
464	Unicorn-27298.exe
4548	Unicorn-38234.exe
4044	Unicorn-27564.exe
1848	Unicorn-34108.exe
4060	Unicorn-14242.exe
3184	Unicorn-2130.exe
3104	Unicorn-48259.exe
3172	Unicorn-2587.exe
1508	Unicorn-53516.exe
4336	Unicorn-37180.exe
4780	Unicorn-4507.exe
4368	Unicorn-52940.exe
1232	Unicorn-3931.exe
2756	Unicorn-3931.exe
3688	Unicorn-53625.exe
4640	Unicorn-53625.exe
524	Unicorn-13753.exe
2488	Unicorn-46618.exe
912	Unicorn-51907.exe
4620	Unicorn-26706.exe
1164	Unicorn-43242.exe
4972	Unicorn-32306.exe
3260	Unicorn-13369.exe
4672	Unicorn-65171.exe
1532	Unicorn-61020.exe
4304	Unicorn-24818.exe
4376	Unicorn-62556.exe
4496	Unicorn-11087.exe
1860	Unicorn-24822.exe
3332	Unicorn-47564.exe
3892	Unicorn-29033.exe
1500	Unicorn-6360.exe
5084	Unicorn-15689.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1500	4148	WerFault.exe	94
1188	4148	WerFault.exe	94
1532	4928	WerFault.exe	103
1364	4928	WerFault.exe	103
4652	2356	WerFault.exe	111
1972	2356	WerFault.exe	111
3472	3424	WerFault.exe	117
3636	3440	WerFault.exe	98
4300	3580	WerFault.exe	100
3712	3440	WerFault.exe	98
1924	3424	WerFault.exe	117
2880	3580	WerFault.exe	100
2184	1848	WerFault.exe	127
2056	1848	WerFault.exe	127
4308	1508	WerFault.exe	136
2976	1508	WerFault.exe	136
3712	3688	WerFault.exe	143
5212	4640	WerFault.exe	144
5192	3260	WerFault.exe	152
5920	5060	WerFault.exe	95
4028	912	WerFault.exe	147
5736	2548	WerFault.exe	177
5992	3260	WerFault.exe	152
6188	3700	WerFault.exe	205
5104	964	WerFault.exe	196
2268	5588	WerFault.exe	228
7080	3584	WerFault.exe	207
7968	3076	WerFault.exe	206
6936	5288	WerFault.exe	303
7724	6064	WerFault.exe	353
5512	4216	WerFault.exe	369
10256	5888	WerFault.exe	419
10248	4532	WerFault.exe	407
10136	5308	WerFault.exe	300
9344	4148	WerFault.exe	284
9940	6972	WerFault.exe	330
9480	7808	WerFault.exe	442
10232	7512	WerFault.exe	431
10128	7440	WerFault.exe	428
10004	8052	WerFault.exe	453
11260	1540	WerFault.exe	294
11252	5328	WerFault.exe	296
11216	5720	WerFault.exe	289
11128	5636	WerFault.exe	231
10828	6420	WerFault.exe	319
11096	7792	WerFault.exe	441
5460	8012	WerFault.exe	452
2792	7408	WerFault.exe	465
4464	4152	WerFault.exe	490
11028	6564	WerFault.exe	503
9908	7536	WerFault.exe	468
2600	7896	WerFault.exe	447
5800	7652	WerFault.exe	469
11236	524	WerFault.exe	145
8560	8140	WerFault.exe	486
10984	5452	WerFault.exe	476
1600	5916	WerFault.exe	310
10656	432	WerFault.exe	489
7472	7948	WerFault.exe	450
10652	972	WerFault.exe	209
11612	7072	WerFault.exe	334
11892	5708	WerFault.exe	234
12192	8752	WerFault.exe	535
12176	6580	WerFault.exe	357

System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53625.exe

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe
4520	Unicorn-7902.exe
444	Unicorn-7653.exe
2024	Unicorn-53325.exe
3808	Unicorn-56543.exe
4148	Unicorn-4005.exe
5060	Unicorn-23871.exe
3940	Unicorn-53620.exe
4220	Unicorn-42335.exe
3012	Unicorn-5557.exe
3440	Unicorn-9662.exe
1264	Unicorn-52157.exe
3580	Unicorn-55334.exe
4160	Unicorn-9662.exe
4928	Unicorn-25158.exe
2472	Unicorn-61388.exe
2460	Unicorn-26447.exe
2356	Unicorn-64076.exe
4232	Unicorn-58138.exe
3432	Unicorn-63692.exe
1272	Unicorn-63884.exe
1312	Unicorn-48617.exe
1052	Unicorn-59971.exe
3424	Unicorn-42487.exe
464	Unicorn-27298.exe
860	Unicorn-14034.exe
3648	Unicorn-63884.exe
4548	Unicorn-38234.exe
4044	Unicorn-27564.exe
4060	Unicorn-14242.exe
1848	Unicorn-34108.exe
3184	Unicorn-2130.exe
3172	Unicorn-2587.exe
3104	Unicorn-48259.exe
1508	Unicorn-53516.exe
4336	Unicorn-37180.exe
4780	Unicorn-4507.exe
4368	Unicorn-52940.exe
2756	Unicorn-3931.exe
4640	Unicorn-53625.exe
524	Unicorn-13753.exe
1232	Unicorn-3931.exe
912	Unicorn-51907.exe
3688	Unicorn-53625.exe
1164	Unicorn-43242.exe
4972	Unicorn-32306.exe
2488	Unicorn-46618.exe
4620	Unicorn-26706.exe
3260	Unicorn-13369.exe
4672	Unicorn-65171.exe
1532	Unicorn-61020.exe
4304	Unicorn-24818.exe
4376	Unicorn-62556.exe
4496	Unicorn-11087.exe
1860	Unicorn-24822.exe
3332	Unicorn-47564.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4520	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	87
PID 228 wrote to memory of 4520	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	87
PID 228 wrote to memory of 4520	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	87
PID 228 wrote to memory of 2024	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	89
PID 228 wrote to memory of 2024	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	89
PID 228 wrote to memory of 2024	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	89
PID 4520 wrote to memory of 444	4520	Unicorn-7902.exe	90
PID 4520 wrote to memory of 444	4520	Unicorn-7902.exe	90
PID 4520 wrote to memory of 444	4520	Unicorn-7902.exe	90
PID 444 wrote to memory of 3808	444	Unicorn-7653.exe	93
PID 444 wrote to memory of 3808	444	Unicorn-7653.exe	93
PID 444 wrote to memory of 3808	444	Unicorn-7653.exe	93
PID 4520 wrote to memory of 4148	4520	Unicorn-7902.exe	94
PID 4520 wrote to memory of 4148	4520	Unicorn-7902.exe	94
PID 4520 wrote to memory of 4148	4520	Unicorn-7902.exe	94
PID 2024 wrote to memory of 5060	2024	Unicorn-53325.exe	95
PID 2024 wrote to memory of 5060	2024	Unicorn-53325.exe	95
PID 2024 wrote to memory of 5060	2024	Unicorn-53325.exe	95
PID 228 wrote to memory of 3940	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	96
PID 228 wrote to memory of 3940	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	96
PID 228 wrote to memory of 3940	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	96
PID 3808 wrote to memory of 4220	3808	Unicorn-56543.exe	97
PID 3808 wrote to memory of 4220	3808	Unicorn-56543.exe	97
PID 3808 wrote to memory of 4220	3808	Unicorn-56543.exe	97
PID 5060 wrote to memory of 4160	5060	Unicorn-23871.exe	99
PID 3940 wrote to memory of 3440	3940	Unicorn-53620.exe	98
PID 5060 wrote to memory of 4160	5060	Unicorn-23871.exe	99
PID 5060 wrote to memory of 4160	5060	Unicorn-23871.exe	99
PID 3940 wrote to memory of 3440	3940	Unicorn-53620.exe	98
PID 3940 wrote to memory of 3440	3940	Unicorn-53620.exe	98
PID 444 wrote to memory of 3580	444	Unicorn-7653.exe	100
PID 444 wrote to memory of 3580	444	Unicorn-7653.exe	100
PID 444 wrote to memory of 3580	444	Unicorn-7653.exe	100
PID 2024 wrote to memory of 3012	2024	Unicorn-53325.exe	102
PID 2024 wrote to memory of 3012	2024	Unicorn-53325.exe	102
PID 2024 wrote to memory of 3012	2024	Unicorn-53325.exe	102
PID 228 wrote to memory of 4928	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	103
PID 228 wrote to memory of 4928	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	103
PID 228 wrote to memory of 4928	228	bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe	103
PID 4520 wrote to memory of 1264	4520	Unicorn-7902.exe	104
PID 4520 wrote to memory of 1264	4520	Unicorn-7902.exe	104
PID 4520 wrote to memory of 1264	4520	Unicorn-7902.exe	104
PID 4220 wrote to memory of 2472	4220	Unicorn-42335.exe	109
PID 4220 wrote to memory of 2472	4220	Unicorn-42335.exe	109
PID 4220 wrote to memory of 2472	4220	Unicorn-42335.exe	109
PID 3808 wrote to memory of 2460	3808	Unicorn-56543.exe	110
PID 3808 wrote to memory of 2460	3808	Unicorn-56543.exe	110
PID 3808 wrote to memory of 2460	3808	Unicorn-56543.exe	110
PID 3012 wrote to memory of 2356	3012	Unicorn-5557.exe	111
PID 3012 wrote to memory of 2356	3012	Unicorn-5557.exe	111
PID 3012 wrote to memory of 2356	3012	Unicorn-5557.exe	111
PID 2024 wrote to memory of 4232	2024	Unicorn-53325.exe	112
PID 2024 wrote to memory of 4232	2024	Unicorn-53325.exe	112
PID 2024 wrote to memory of 4232	2024	Unicorn-53325.exe	112
PID 3580 wrote to memory of 3432	3580	Unicorn-55334.exe	113
PID 3580 wrote to memory of 3432	3580	Unicorn-55334.exe	113
PID 3580 wrote to memory of 3432	3580	Unicorn-55334.exe	113
PID 1264 wrote to memory of 3648	1264	Unicorn-52157.exe	114
PID 1264 wrote to memory of 3648	1264	Unicorn-52157.exe	114
PID 1264 wrote to memory of 3648	1264	Unicorn-52157.exe	114
PID 3440 wrote to memory of 1272	3440	Unicorn-9662.exe	115
PID 3440 wrote to memory of 1272	3440	Unicorn-9662.exe	115
PID 3440 wrote to memory of 1272	3440	Unicorn-9662.exe	115
PID 4160 wrote to memory of 1312	4160	Unicorn-9662.exe	116

C:\Users\Admin\AppData\Local\Temp\bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe
"C:\Users\Admin\AppData\Local\Temp\bec3d8e7425ceb6b2f8852a7472b6ec9b29f748d27c1d434ccbbfb51e5570426N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        9⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
        9⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
        10⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        11⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8220 -s 720
        12⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 668
        11⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        10⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 636
        11⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44746.exe
        10⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        10⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        9⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        10⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        10⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9965.exe
        10⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59610.exe
        9⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        10⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
        9⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        9⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37914.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        9⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        10⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        11⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        10⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16877.exe
        10⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        9⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64332.exe
        10⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        10⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 644
        9⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18450.exe
        8⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 636
        9⤵
        Program crash
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35696.exe
        9⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24818.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        8⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        9⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        9⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44956.exe
        10⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8452 -s 636
        11⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37071.exe
        10⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46846.exe
        10⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
        9⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33212.exe
        10⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        10⤵
        
        PID:15300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 632
        9⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53011.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
        9⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 632
        9⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19661.exe
        9⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19785.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50634.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        8⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        9⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        8⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8674.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62556.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34041.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16690.exe
        8⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29852.exe
        9⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7792 -s 640
        10⤵
        Program crash
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
        9⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14363.exe
        10⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 736
        9⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        9⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7916 -s 668
        9⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58371.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32525.exe
        9⤵
        
        PID:14260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 748
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13298.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33743.exe
        8⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28060.exe
        9⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9116 -s 640
        10⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 648
        9⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52599.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        9⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        9⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58147.exe
        7⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 616
        8⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 772
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39069.exe
        9⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8100 -s 720
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2153.exe
        7⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33309.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15650.exe
        7⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
        6⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        7⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        6⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
        9⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        10⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62268.exe
        11⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        12⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 656
        11⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        10⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13979.exe
        11⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4294.exe
        11⤵
        
        PID:13772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 644
        10⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14312.exe
        9⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        10⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4575.exe
        11⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        10⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6160 -s 628
        9⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 740
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16370.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6955.exe
        8⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 636
        9⤵
        Program crash
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63292.exe
        8⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33369.exe
        9⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38301.exe
        10⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37855.exe
        9⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        9⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        8⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 744
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        7⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7236 -s 644
        8⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 756
        7⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54035.exe
        6⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10216.exe
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49555.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
        8⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
        9⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        9⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 632
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52282.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        8⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 740
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18393.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10171.exe
        9⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 636
        10⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 632
        9⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        9⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        8⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34098.exe
        8⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52506.exe
        7⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 664
        7⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42188.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        8⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
        8⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 624
        7⤵
        Program crash
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-504.exe
        7⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7860 -s 736
        7⤵
        
        PID:13896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 660
        6⤵
        Program crash
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        6⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52700.exe
        7⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48186.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32540.exe
        6⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        7⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 636
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        7⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44912.exe
        7⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57735.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58020.exe
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52352.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        6⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18784.exe
        7⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        6⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        5⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56476.exe
        6⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        5⤵
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 716
        5⤵
        Program crash
        
        PID:4300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 748
        5⤵
        Program crash
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 724
        5⤵
        Program crash
        
        PID:3472
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 724
        5⤵
        Program crash
        
        PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51907.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 632
        5⤵
        Program crash
        
        PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
      4⤵
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23484.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        6⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
        7⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9001.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25815.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        5⤵
        
        PID:7408
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7408 -s 632
        6⤵
        Program crash
        
        PID:2792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 656
        5⤵
        Program crash
        
        PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
      4⤵
      PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
      4⤵
      PID:4388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 636
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4209.exe
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20826.exe
      4⤵
      PID:11856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 636
      4⤵
      Program crash
      PID:1500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 636
      4⤵
      Program crash
      PID:1188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 636
        6⤵
        Program crash
        
        PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exe
        5⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24140.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48323.exe
        8⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        7⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        8⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
        7⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5746.exe
        6⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16860.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        8⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 756
        7⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36201.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        6⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        6⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 636
        7⤵
        Program crash
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44723.exe
        6⤵
        
        PID:4708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 628
        6⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51123.exe
        5⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        6⤵
        
        PID:688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 724
        7⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        6⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52141.exe
        7⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        5⤵
        
        PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26528.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        5⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        6⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14475.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61100.exe
        9⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 728
        10⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 656
        9⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25874.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2748.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        8⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41807.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12732.exe
        9⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 632
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44618.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4586.exe
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-847.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6731.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53293.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        7⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        6⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        7⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        6⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8875.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42540.exe
        7⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7440 -s 616
        8⤵
        Program crash
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28962.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        7⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-194.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        7⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4265.exe
        6⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        7⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58745.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        7⤵
        
        PID:11964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 628
        6⤵
        Program crash
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41811.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        6⤵
        
        PID:9712
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 756
        5⤵
        
        PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
      4⤵
      PID:3584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 632
        5⤵
        Program crash
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
      4⤵
      PID:6564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 640
        5⤵
        Program crash
        
        PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
      4⤵
      PID:12992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27113.exe
        5⤵
        
        PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46467.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47863.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45827.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        6⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10130.exe
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
        5⤵
        
        PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
      4⤵
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50764.exe
        5⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23884.exe
        6⤵
        
        PID:6908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 756
        6⤵
        Program crash
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        6⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12194.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7386.exe
        7⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33926.exe
        6⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56138.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22925.exe
        6⤵
        
        PID:14312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 672
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62138.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        5⤵
        
        PID:7100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 716
        5⤵
        Program crash
        
        PID:9940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
      4⤵
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20985.exe
        5⤵
        
        PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5970.exe
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
    3⤵
    PID:3928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32705.exe
    3⤵
    PID:7652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 636
      4⤵
      Program crash
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43354.exe
    3⤵
    PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
    3⤵
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 648
        7⤵
        Program crash
        
        PID:4308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 648
        7⤵
        Program crash
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21554.exe
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
        6⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16505.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56492.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        9⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36786.exe
        9⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 636
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33554.exe
        7⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8752 -s 636
        8⤵
        Program crash
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        7⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60803.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53691.exe
        7⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65171.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9311.exe
        7⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 744
        7⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20831.exe
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8182.exe
        6⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 636
        7⤵
        Program crash
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61936.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        6⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        5⤵
        
        PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49539.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        6⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        7⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        6⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
        5⤵
        
        PID:8052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8052 -s 636
        6⤵
        Program crash
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57292.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64006.exe
        5⤵
        
        PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56540.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        9⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 760
        10⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        9⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8696.exe
        10⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        11⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33110.exe
        10⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 636
        9⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        9⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 636
        10⤵
        
        PID:14396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 636
        9⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65427.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13243.exe
        8⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 636
        9⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 636
        9⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51843.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16480.exe
        9⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15177.exe
        8⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20870.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50025.exe
        8⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 748
        7⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        7⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23836.exe
        8⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40492.exe
        9⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17554.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        8⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18489.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        7⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38466.exe
        5⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        8⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7196 -s 648
        7⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        6⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        7⤵
        
        PID:14000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 668
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38819.exe
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
        5⤵
        
        PID:4692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 772
        5⤵
        
        PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46618.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27497.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18802.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42130.exe
        5⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57116.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        7⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 640
        8⤵
        Program crash
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        7⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        6⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7536 -s 636
        7⤵
        Program crash
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
        6⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-636.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9890.exe
        6⤵
        
        PID:6868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 720
      4⤵
      Program crash
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 636
        5⤵
        Program crash
        
        PID:4652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 680
        5⤵
        Program crash
        
        PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48259.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18665.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        7⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        8⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 676
        8⤵
        Program crash
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11000.exe
        9⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        9⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        8⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 736
        7⤵
        Program crash
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31106.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45532.exe
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
        8⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 628
        8⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7072 -s 660
        7⤵
        Program crash
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
        6⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
        7⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
        6⤵
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50188.exe
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34511.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        7⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        6⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        7⤵
        
        PID:14328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 724
        6⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38023.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15689.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24937.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43840.exe
        5⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        6⤵
        
        PID:10740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 656
        5⤵
        Program crash
        
        PID:11892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        6⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21389.exe
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        5⤵
        
        PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-82.exe
      4⤵
      PID:4336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 636
        5⤵
        
        PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25740.exe
      4⤵
      PID:10460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26161.exe
      4⤵
      PID:11392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 648
        5⤵
        Program crash
        
        PID:2184
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 648
        5⤵
        Program crash
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49308.exe
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3535.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57676.exe
        6⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9820 -s 636
        7⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63209.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
        7⤵
        
        PID:12264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 652
        6⤵
        Program crash
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2310.exe
      4⤵
      PID:7892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7892 -s 636
        5⤵
        
        PID:3492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 508
      4⤵
      PID:12220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19817.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
      4⤵
      PID:5588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 636
        5⤵
        Program crash
        
        PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31494.exe
      4⤵
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45916.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25090.exe
        5⤵
        
        PID:8236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8236 -s 636
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28009.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        5⤵
        
        PID:1284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33740.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48761.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44828.exe
        6⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 644
        7⤵
        Program crash
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        5⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28428.exe
        6⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 724
        7⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14274.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12362.exe
        6⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        5⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23018.exe
        5⤵
        
        PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        6⤵
        
        PID:8892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7524 -s 652
        6⤵
        
        PID:13968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 656
        5⤵
        Program crash
        
        PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      4⤵
      PID:8012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8012 -s 632
        5⤵
        Program crash
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
      4⤵
      PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
      4⤵
      PID:11748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
      4⤵
      PID:15324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
    3⤵
    PID:6064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 636
      4⤵
      Program crash
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28481.exe
    3⤵
    PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14939.exe
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
      4⤵
      PID:14140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64411.exe
    3⤵
    PID:10440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25026.exe
    3⤵
    PID:8472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24041.exe
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42204.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39628.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35612.exe
        8⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6632.exe
        9⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 756
        9⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 640
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
        7⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8800 -s 644
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37155.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62427.exe
        7⤵
        
        PID:14280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30425.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26352.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        7⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30626.exe
        6⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        5⤵
        
        PID:964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 632
        6⤵
        Program crash
        
        PID:5104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 740
      4⤵
      Program crash
      PID:3636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 740
      4⤵
      Program crash
      PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39308.exe
        5⤵
        
        PID:2548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 708
        6⤵
        Program crash
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28316.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10955.exe
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46688.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53555.exe
        7⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13827.exe
        8⤵
        
        PID:14492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 636
        7⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16185.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21042.exe
        6⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
      4⤵
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3816.exe
        5⤵
        
        PID:5888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 636
        6⤵
        Program crash
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28578.exe
        5⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16864.exe
        6⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        5⤵
        
        PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53728.exe
      4⤵
      PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33196.exe
        5⤵
        
        PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1465.exe
      4⤵
      PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20429.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55987.exe
      4⤵
      PID:4888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 632
      4⤵
      Program crash
      PID:5192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 672
      4⤵
      Program crash
      PID:5992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31171.exe
    3⤵
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19961.exe
        5⤵
        
        PID:5868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 628
        5⤵
        Program crash
        
        PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16530.exe
      4⤵
      PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        5⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        6⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        5⤵
        
        PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
      4⤵
      PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-367.exe
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57819.exe
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44730.exe
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
    3⤵
    PID:7788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 644
      4⤵
      PID:1404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 676
    3⤵
    PID:11808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 720
    3⤵
    - Program crash
    PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 764
    3⤵
    - Program crash
    PID:1364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53625.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 636
      4⤵
      Program crash
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61347.exe
    3⤵
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6459.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        6⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 636
        7⤵
        Program crash
        
        PID:2600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7896 -s 636
        7⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39263.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
        6⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        5⤵
        
        PID:432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 636
        6⤵
        Program crash
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56071.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        5⤵
        
        PID:2140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 724
      4⤵
      Program crash
      PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51946.exe
    3⤵
    PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
    3⤵
    PID:4152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 628
      4⤵
      Program crash
      PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
    3⤵
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
      4⤵
      PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61379.exe
    3⤵
    PID:12780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
    3⤵
    PID:692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
        5⤵
        
        PID:5452
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 636
        6⤵
        Program crash
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41987.exe
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4018.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57207.exe
      4⤵
      PID:5188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 716
      4⤵
      PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35996.exe
      4⤵
      PID:6528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 656
      4⤵
      Program crash
      PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14505.exe
    3⤵
    PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
      4⤵
      PID:15240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59331.exe
    3⤵
    PID:10100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
    3⤵
    PID:10612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7275.exe
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 716
    3⤵
    - Program crash
    PID:6188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
  2⤵
  PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64259.exe
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      4⤵
      PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
      4⤵
      PID:13836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23895.exe
    3⤵
    PID:3320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60122.exe
  2⤵
  PID:7808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7808 -s 636
    3⤵
    - Program crash
    PID:9480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
  2⤵
  PID:9668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38795.exe
  2⤵
  PID:11348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
  2⤵
  PID:15284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4148 -ip 4148
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4148 -ip 4148
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4928 -ip 4928
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4928 -ip 4928
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2356 -ip 2356
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2356 -ip 2356
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3424 -ip 3424
1⤵
PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3440 -ip 3440
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3580 -ip 3580
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3424 -ip 3424
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3440 -ip 3440
1⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3580 -ip 3580
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1848 -ip 1848
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1508 -ip 1508
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1848 -ip 1848
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1508 -ip 1508
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3688 -ip 3688
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3260 -ip 3260
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4640 -ip 4640
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1232 -ip 1232
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 912 -ip 912
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3432 -ip 3432
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5060 -ip 5060
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 912 -ip 912
1⤵
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1232 -ip 1232
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1860 -ip 1860
1⤵
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3432 -ip 3432
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5084 -ip 5084
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3688 -ip 3688
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2548 -ip 2548
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1860 -ip 1860
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5084 -ip 5084
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2548 -ip 2548
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3260 -ip 3260
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4640 -ip 4640
1⤵
PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3700 -ip 3700
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 3272 -ip 3272
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 964 -ip 964
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3276 -ip 3276
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3224 -ip 3224
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 64 -ip 64
1⤵
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4432 -ip 4432
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 964 -ip 964
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3700 -ip 3700
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3272 -ip 3272
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3224 -ip 3224
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3584 -ip 3584
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3276 -ip 3276
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 64 -ip 64
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4432 -ip 4432
1⤵
PID:6176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5060 -ip 5060
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1272 -ip 1272
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1164 -ip 1164
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4304 -ip 4304
1⤵
PID:6916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5164 -ip 5164
1⤵
PID:7016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5136 -ip 5136
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 5160 -ip 5160
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5228 -ip 5228
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5648 -ip 5648
1⤵
PID:6260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5980 -ip 5980
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5968 -ip 5968
1⤵
PID:6900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3936 -ip 3936
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5444 -ip 5444
1⤵
PID:7052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5588 -ip 5588
1⤵
PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5548 -ip 5548
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3584 -ip 3584
1⤵
PID:7064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5696 -ip 5696
1⤵
PID:6556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5848 -ip 5848
1⤵
PID:6564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 1272 -ip 1272
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1164 -ip 1164
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2488 -ip 2488
1⤵
PID:6260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3332 -ip 3332
1⤵
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1780 -ip 1780
1⤵
PID:7100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 1532 -ip 1532
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4336 -ip 4336
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4304 -ip 4304
1⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5136 -ip 5136
1⤵
PID:7156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5160 -ip 5160
1⤵
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5164 -ip 5164
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5228 -ip 5228
1⤵
PID:6556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3076 -ip 3076
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5648 -ip 5648
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 5036 -ip 5036
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5796 -ip 5796
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5512 -ip 5512
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5968 -ip 5968
1⤵
PID:6676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5980 -ip 5980
1⤵
PID:7028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3936 -ip 3936
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5444 -ip 5444
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5548 -ip 5548
1⤵
PID:7176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5848 -ip 5848
1⤵
PID:7252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2228 -ip 2228
1⤵
PID:7328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2488 -ip 2488
1⤵
PID:7476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5696 -ip 5696
1⤵
PID:7536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3332 -ip 3332
1⤵
PID:7604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 1780 -ip 1780
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1532 -ip 1532
1⤵
PID:7748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4336 -ip 4336
1⤵
PID:7968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5172 -ip 5172
1⤵
PID:7424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3076 -ip 3076
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5512 -ip 5512
1⤵
PID:7836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5796 -ip 5796
1⤵
PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5744 -ip 5744
1⤵
PID:7776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5036 -ip 5036
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5288 -ip 5288
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5424 -ip 5424
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6244 -ip 6244
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3568 -ip 3568
1⤵
PID:7308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6460 -ip 6460
1⤵
PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6100 -ip 6100
1⤵
PID:7184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 2720 -ip 2720
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6888 -ip 6888
1⤵
PID:8072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3928 -ip 3928
1⤵
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5748 -ip 5748
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5340 -ip 5340
1⤵
PID:8160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 1960 -ip 1960
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 2228 -ip 2228
1⤵
PID:8284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 860 -ip 860
1⤵
PID:8420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5780 -ip 5780
1⤵
PID:8552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6252 -ip 6252
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5460 -ip 5460
1⤵
PID:8732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4216 -ip 4216
1⤵
PID:8772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6064 -ip 6064
1⤵
PID:8788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 7148 -ip 7148
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1860 -ip 1860
1⤵
PID:8980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5380 -ip 5380
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7012 -ip 7012
1⤵
PID:9200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 7092 -ip 7092
1⤵
PID:8428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6956 -ip 6956
1⤵
PID:8708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5172 -ip 5172
1⤵
PID:8424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6572 -ip 6572
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3104 -ip 3104
1⤵
PID:8556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1644 -ip 1644
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6512 -ip 6512
1⤵
PID:7080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1136 -ip 1136
1⤵
PID:8892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1952 -ip 1952
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5800 -ip 5800
1⤵
PID:8896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 7004 -ip 7004
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6532 -ip 6532
1⤵
PID:8916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5744 -ip 5744
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5424 -ip 5424
1⤵
PID:7776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6244 -ip 6244
1⤵
PID:9156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2460 -ip 2460
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 6460 -ip 6460
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3568 -ip 3568
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3184 -ip 3184
1⤵
PID:8836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2720 -ip 2720
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6100 -ip 6100
1⤵
PID:8812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2284 -ip 2284
1⤵
PID:8860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2824 -ip 2824
1⤵
PID:8880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2384 -ip 2384
1⤵
PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 4908 -ip 4908
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1788 -ip 1788
1⤵
PID:8848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4368 -ip 4368
1⤵
PID:9084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5264 -ip 5264
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6908 -ip 6908
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 7376 -ip 7376
1⤵
PID:6244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7100 -ip 7100
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5868 -ip 5868
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1808 -ip 1808
1⤵
PID:8112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 5420 -ip 5420
1⤵
PID:7936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6888 -ip 6888
1⤵
PID:8488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 1960 -ip 1960
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 5748 -ip 5748
1⤵
PID:7108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5340 -ip 5340
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 3928 -ip 3928
1⤵
PID:9324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 860 -ip 860
1⤵
PID:9476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5780 -ip 5780
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5588 -ip 5588
1⤵
PID:9876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6528 -ip 6528
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 7432 -ip 7432
1⤵
PID:9680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 5436 -ip 5436
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 7052 -ip 7052
1⤵
PID:10132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5488 -ip 5488
1⤵
PID:10228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5964 -ip 5964
1⤵
PID:9712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4532 -ip 4532
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5308 -ip 5308
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 4148 -ip 4148
1⤵
PID:9952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6972 -ip 6972
1⤵
PID:7632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 5888 -ip 5888
1⤵
PID:9936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 5460 -ip 5460
1⤵
PID:7800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 7148 -ip 7148
1⤵
PID:9712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 6252 -ip 6252
1⤵
PID:10296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1860 -ip 1860
1⤵
PID:10356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5380 -ip 5380
1⤵
PID:10532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 7012 -ip 7012
1⤵
PID:10604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7092 -ip 7092
1⤵
PID:10652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3104 -ip 3104
1⤵
PID:10656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 6956 -ip 6956
1⤵
PID:10672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 6572 -ip 6572
1⤵
PID:10696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1644 -ip 1644
1⤵
PID:10832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 5800 -ip 5800
1⤵
PID:10908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1952 -ip 1952
1⤵
PID:10952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6008 -ip 6008
1⤵
PID:10996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 7004 -ip 7004
1⤵
PID:11096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 6532 -ip 6532
1⤵
PID:11208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5636 -ip 5636
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5328 -ip 5328
1⤵
PID:9340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1540 -ip 1540
1⤵
PID:10268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 1136 -ip 1136
1⤵
PID:1336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 6512 -ip 6512
1⤵
PID:9376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 8052 -ip 8052
1⤵
PID:10852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5720 -ip 5720
1⤵
PID:10704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7440 -ip 7440
1⤵
PID:11052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 7512 -ip 7512
1⤵
PID:11092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7808 -ip 7808
1⤵
PID:11124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 3184 -ip 3184
1⤵
PID:10532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2460 -ip 2460
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 2284 -ip 2284
1⤵
PID:9056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2824 -ip 2824
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1788 -ip 1788
1⤵
PID:11504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 2384 -ip 2384
1⤵
PID:11688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 7948 -ip 7948
1⤵
PID:11956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4908 -ip 4908
1⤵
PID:12240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 432 -ip 432
1⤵
PID:10316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 4368 -ip 4368
1⤵
PID:12120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 7100 -ip 7100
1⤵
PID:11316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5264 -ip 5264
1⤵
PID:8968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6420 -ip 6420
1⤵
PID:12236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 8140 -ip 8140
1⤵
PID:12008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5452 -ip 5452
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5868 -ip 5868
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6908 -ip 6908
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 7376 -ip 7376
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5420 -ip 5420
1⤵
PID:12408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5916 -ip 5916
1⤵
PID:12572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1808 -ip 1808
1⤵
PID:12652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 524 -ip 524
1⤵
PID:12728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 7652 -ip 7652
1⤵
PID:13104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7896 -ip 7896
1⤵
PID:8964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 7536 -ip 7536
1⤵
PID:12328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 6564 -ip 6564
1⤵
PID:12908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7792 -ip 7792
1⤵
PID:12848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 4152 -ip 4152
1⤵
PID:12972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 7408 -ip 7408
1⤵
PID:11804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 8012 -ip 8012
1⤵
PID:7496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7236 -ip 7236
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 6044 -ip 6044
1⤵
PID:12604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 972 -ip 972
1⤵
PID:8296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 7072 -ip 7072
1⤵
PID:13076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5708 -ip 5708
1⤵
PID:13144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6528 -ip 6528
1⤵
PID:13040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 3172 -ip 3172
1⤵
PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 6160 -ip 6160
1⤵
PID:12336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1268 -ip 1268
1⤵
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6580 -ip 6580
1⤵
PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5436 -ip 5436
1⤵
PID:12656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 7432 -ip 7432
1⤵
PID:11968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 7052 -ip 7052
1⤵
PID:13376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 8752 -ip 8752
1⤵
PID:13384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 5488 -ip 5488
1⤵
PID:13424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5964 -ip 5964
1⤵
PID:13436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 4232 -ip 4232
1⤵
PID:13520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6944 -ip 6944
1⤵
PID:13576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7060 -ip 7060
1⤵
PID:13760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3940 -ip 3940
1⤵
PID:13816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4060 -ip 4060
1⤵
PID:13828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1724 -ip 1724
1⤵
PID:13836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4972 -ip 4972
1⤵
PID:13852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3308 -ip 3308
1⤵
PID:13860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4200 -ip 4200
1⤵
PID:13872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4336 -ip 4336
1⤵
PID:13932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6760 -ip 6760
1⤵
PID:13960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 7748 -ip 7748
1⤵
PID:13988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 8236 -ip 8236
1⤵
PID:14080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 8800 -ip 8800
1⤵
PID:14088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7036 -ip 7036
1⤵
PID:14128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 5672 -ip 5672
1⤵
PID:14136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 8208 -ip 8208
1⤵
PID:14200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7196 -ip 7196
1⤵
PID:14228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1272 -ip 1272
1⤵
PID:13076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7880 -ip 7880
1⤵
PID:13704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7892 -ip 7892
1⤵
PID:13832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 7788 -ip 7788
1⤵
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 8452 -ip 8452
1⤵
PID:14320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 8220 -ip 8220
1⤵
PID:13388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4388 -ip 4388
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3516 -ip 3516
1⤵
PID:13992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 5088 -ip 5088
1⤵
PID:14132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9116 -ip 9116
1⤵
PID:14364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 5900 -ip 5900
1⤵
PID:14372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5988 -ip 5988
1⤵
PID:14640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1104 -ip 1104
1⤵
PID:14724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4828 -ip 4828
1⤵
PID:14736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 692 -ip 692
1⤵
PID:14748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 7916 -ip 7916
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 688 -ip 688
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 464 -ip 464
1⤵
PID:14932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 8100 -ip 8100
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 5276 -ip 5276
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6284 -ip 6284
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14034.exe

Filesize
468KB

MD5
1ce90e26d07bf20c0e361deea8d9243b

SHA1
540f30ae08e2b955f85a03ee5d6139539d781f31

SHA256
8386a6de8f9e59b4d966fa9d5d5224a00812f145c00f7e6b987a974f903dbb2a

SHA512
d3c86aea89914921bc0275f551f844ae43bf37876aeee46e82d954b26e10942a6c53d2a274d2d3c36186a71d0afd52a92261e19c125f70105edf671c0240edc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe

Filesize
468KB

MD5
c736471c1b5e8ebc229948d3151b85ed

SHA1
49454fc9f34b10e13c74d69ee1e893d423f20924

SHA256
91be4a4a73e3ba0a2889b7a095ad5737d0d25d466da3be9a1957a2b5eb1889bd

SHA512
670ea42e403e0f606c65e1a97a615e922727d95e87d15aa9a5c03478dadff566da62efe03c774ce8cdada98a5ff5407f5bada6c93bb2651eb55675736b164154

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe

Filesize
468KB

MD5
2e50d6f517698eb229fc62a1b4f531a9

SHA1
641424d57c28088f17d1b31249e3e13bc2ca4381

SHA256
ec0c3012fc24f1d6f010d9f8fc706c1183fd4068a400851175897382b3ad8c0a

SHA512
a169f1c99c5ffc2b18e45f6c446c6bbc3965f82866e79b124bd870c44debdb50930f567db99659599fd9d4ab0d94cc19097be54cab6a8f53da8cc12404c86ce9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe

Filesize
468KB

MD5
dcd85efd20e268d6696d23fa51ec1a05

SHA1
c5704f9efeb33706272404de1bc705a82f689866

SHA256
d739af4206fea1121f9fa037494ba21e0eee2f4d45b1b9cc4fb639318f2df508

SHA512
7ef49711fcedd114167598aab0d27e0ac4b4ce34c2c6693c4d412d460504c1916a1bab26e0cc0ee4d2b9e10d50a88262f2285beeab79c08069cfa54cf618db20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25158.exe

Filesize
468KB

MD5
d6a8531150e64a1b71a99aa1c9e90207

SHA1
0df713bd3c7a09540d8a034266c6513164cc2f4d

SHA256
637ca82ffad32346ae1839ac3a37db532617bfc2dc6464a23ca913c6c1e40900

SHA512
39e2bbd98e8fa4b17cdf6a15e09dfef97513ce2d554c410782b5fdd25c6c59fdc8dda9f094fa4c669d42166cd782799c79ea9eebc565b8fd187d6bbc247f5c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2587.exe

Filesize
468KB

MD5
ab7a33fed27bf2a99a875a8621665c0a

SHA1
12e9f9737d5692a256c2b07a6606906190d85c30

SHA256
2b4dc6469fe0b00c60f707c0c1282df5581b78f05b3c928e336eb39034eabbe9

SHA512
6859debd5ec23ffaea8d8ece2823d7b71ba2116aa8fbc762b9883bd5c464f83aaea13c79aa3f42081e690e72b2e02a585110c4223de6a6e28004707c54ab7155

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26447.exe

Filesize
468KB

MD5
d6283facadb9da7e03c6860f342277be

SHA1
ae9da270cc4972186b54458c2b3317946027764c

SHA256
0d47d930789b15b13c9f18f3d2818eaf955b3cb7c88b3053acbe194d310ae6fe

SHA512
455f0db744639a741accbcb80d24a9813c8a9ce0d14039fac7b1e043303da09638a58d065f9e4ff0417a2e745569af6028d188b14a830d2f3d1e8ef4e3262bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe

Filesize
468KB

MD5
c43cc1ac87c7026a5c595d47ab460461

SHA1
a963a6bcefc965c46154ffd420bb0fb40b1e1140

SHA256
6d92ee4993136a56d04409d02cebae6736afce8d232bd1b47926feaf0f2bb601

SHA512
8e04d289b09a44986fdf41c3d096a2ec36605e48379b8af9886ed6e69cce131587da578bae5bd866ac89ed2cdba3e81c336d8697625cabffacfd474b33d05ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27564.exe

Filesize
468KB

MD5
6b1db2299d6bb937fbfaac8fb30d67db

SHA1
482e24fb2c4e90e65a016e2c560d6c991decdcc0

SHA256
7a039be7c4aad806520159da81e504c0df29d0825b1d7a26ca659a0bbb90a22c

SHA512
9f246f90e24c3e66d392a2282febce2b4de456d5daf790b59da60ea80d00f4ed2726009566778567184a36c96ccc6c8884f06e66d9b65ee42fda6d4aa774ff82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe

Filesize
468KB

MD5
574e6fcc98cb70a6efabb18b34f9fb56

SHA1
431121b471d44bf0c7094269aa5bb0afabc0226d

SHA256
ed94922e355630725f9346fe27e202f1af5edce6bd76a10cf5ccbab674aea1ba

SHA512
48ddef25d5408e72f566d27559bf9cfee843f790c1583cbe2cbaa6266cdd659e65db4ba2c40a9e741e320967abaa31203296c8dd5b02a3469df8b64df1008f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe

Filesize
468KB

MD5
626f513c3708c7057b451fa325831589

SHA1
f0939d307849d8dda6a1b8f97b19ff627b1c04fe

SHA256
5cd8d8d81bebe4b70e081f50cb043854dc2d1dc262f39ae6e30bdc341b0e6c14

SHA512
544b41a760d770be39138579c5c2318c5411a831f1186165c1dbb9f2d88820c5a305b7b945b63af513cddc733a820f1341dc45d9c1ddf1383b038e6b17fb47ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38234.exe

Filesize
468KB

MD5
38bb5378deee0fadf3ae4eede2b37b92

SHA1
922c550f86020f60f818cb03cc4448fe49b013ec

SHA256
989ec9644c8727148c474e4b66845eb0558bd9093dccd6a938ae973157244c12

SHA512
7e138d017232761c614e9d79264f72b40bab052fe649e8bc3c86ab1cd4d81eab40bba2f9430f7a866fd3c70cd04832624c5d2761d36883f5b511f5de2ce1a1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe

Filesize
468KB

MD5
bf22b7821275ddec79977c9dae8fe330

SHA1
fd1f65c3f129e0e8571e70e241d199cdb08be282

SHA256
cb04d5715a85cf24940c33fe3f324c103dfe38df52faf758843fb46204b4d086

SHA512
0ed7cac90d1e6d96c422b36632e6cde3cfc59b00ca19dbe097bb1f6663719b295ee313a19f11b83dacfb727b6fcf4e581ad79893b1ac3dc1bf9c600e57414534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe

Filesize
468KB

MD5
fc274e58fdf42015bb9de3d222977ca2

SHA1
dcc7db46c8e11ffab7f5990c63eab8f5be9baade

SHA256
0b3d97831b00ce5fe43ee03a4b67047aa8182dd7424c19ac7ba3d66c6700d304

SHA512
8a1fcf86ef0a9de3acf5ad27d7f6b85fdead0cfba502c72d860d781e2274618f0214d3b20415f626f429ac0b42eea2124ab6987c6dbbd2803b6d6d1304cd5dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42335.exe

Filesize
468KB

MD5
c6cae3536dd53f9394240a86b535362e

SHA1
17c4bb27263e8ce1d91483c928b745e585aea9be

SHA256
a811cd8393932c537f0af84fd213ea8aa783e51b036ab3e0537b8cf94ab8e2f8

SHA512
85cd1d07bb6ec5b79d678a74a87425f7998e6c6759639fd87c9a5ee294eca414254ef21ad4a80403b73c46da9cafcaafb88e60ceaf0794a8e63533727ebf3b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe

Filesize
468KB

MD5
399b300b8153a836112f8b0b111b8bab

SHA1
3edca454cdb70032142b34b6541640c8f0223f72

SHA256
ba7e7b2016b603559472a9e85434ffc472cebfd5a65ce2a6577fa6a6bda367b7

SHA512
3d8d367ea6efc1dc7b6714afc9062850e7f6b6d654b77a770b97b27e1cc8eabd7e46215d3017569c0556eb210e16c63b2e5fe9fbe73efcd366941244e5f2a9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48259.exe

Filesize
468KB

MD5
bcf39bd093414571475362e91a3b2c83

SHA1
7c3cf136b704ec20c5c080965e7ef542cfa11855

SHA256
13ba81879430117d37d497e8a5c86c986a778d8143362507de3553a40eae455b

SHA512
57ee52d55414a0c071151f0fbbcde348b72484ecb109cac098492af5017d23f62f5dec8bd2147a766572d8c530261e472e5191b1e8f6cf0b9ccfc27df8625219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe

Filesize
468KB

MD5
22ab9dfd8c1d78f3953bf83484fd667c

SHA1
a8ce1f5b5dfadf6b277f4a01953ebdae25236da6

SHA256
70116e1daf8fe565cf58b83e8f367a38223313c18b53a7cdaf43b8e4e2759ffb

SHA512
9302051e8224cf60815544aab00c5750ea4f8476e9040901344dbb2559b38a209b9135819b5ea61fa712c61945de7daf59094944810e78d7f6458843512eef47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52157.exe

Filesize
468KB

MD5
919fc6689768523ee31cd32803296820

SHA1
622c2e24daea2ed62bbe82a63a78616a1f1ca894

SHA256
2e6b509d6548686a6c29b8edabfc943fe3c14fd03f5e9755c228c947e93a5e2d

SHA512
ce96702eaeb896202207cdb5dd820ba34fbc7f09266cdbe5bc86e204f49310ca650a0718f96a9f7e4664c3886a8b0cc60e90b4bd2fc412d386d275eb5bc20ff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53325.exe

Filesize
468KB

MD5
52ee565ae990628a69ba7f067bc88ca7

SHA1
a5722f2527d1eda1279a3cacdd1ce9d34287af52

SHA256
e3c3187cfca6a2a18cade53bf46ecbb582d3b742e6d33b9dffd078aed66a3f77

SHA512
167503b83bca62c4dbb2b1ad6c9d9df96503a757de3428bb2f4ab3d7f576df7641be7b16b2b3b094e114069f4afae0553052cff0d974da7a8e8d7e1e4be90baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe

Filesize
468KB

MD5
d5d48c5382e4d909b3ecd34fbf286ff8

SHA1
6161f68bf91835382ba533de9f0e551afddb6d0d

SHA256
51440dad7994a3c63c26dcd33bf19b9aca79464867e60fe1304e493c1f05b4b5

SHA512
51c16d7727c488bda3f43f113f0a4f864fc395a56361b07a2b808b914051f66565961d62733c1ed254bc8d43bdb695fc7821fa6a6650dccfaea2fd00f215d35a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55334.exe

Filesize
468KB

MD5
166cf3cd960ccfc899a3af06f8330626

SHA1
e4473a5a66ebb96082adecc81dfee7bdc5c690ec

SHA256
68c3fe369c121489babb62d21b246acff854d8ea9776c71baa91ff87d490ce05

SHA512
d8ad93716016e1f403cfa14fef88a8611d01929c060f16d4d67f92aff13ea013641f801c1b8e55426184273f9dc2ee1686dd605f3b9ca9c7f0c29cf8ecab18bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe

Filesize
468KB

MD5
560195aff7097ecc0e85d9c4682a3897

SHA1
b66abe4d8a9f26f57daf6547897c4e4d6ff4b0b7

SHA256
faf7707303d094b7bca250c8d0b38df441ccaddc7696e7a990cbe6b54d3b6519

SHA512
9988fc24f00e55e29a34205098e427c7601c860ea89ce3337240078792feca4a5950d2c25fc88d6cff3ce706b3e81dc728ed7cf7e0c7b48e60c58887ef4e46bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe

Filesize
468KB

MD5
ac301c783ebf6a904c1c9540b03798de

SHA1
d4981d09e93c1afdf027e836a43f021fa0eeed55

SHA256
042f9713b6e0b9ea06e9a86f3835623867eac2f9451a520e728ff57771afe88f

SHA512
c949991e8c2eb1959c7d36a706d75a0708fa345bec2809bdc2edec2b417a6bb253e7244c2b5f7ed50661dc51ad03fbcb5e23a60a52f8cd3dcdd2bd7bed5e8667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58138.exe

Filesize
468KB

MD5
d0d4e740fc59ce3b5c9591946a3df632

SHA1
93e1bffdeff56ba055b0d72a06f3b9cd8666cb55

SHA256
6254996e75644b005e42f4792cf44c613f994bb7b061412f0077bd8dabf47446

SHA512
503fffa2e859dc37036770912a5a49b882ff07bc39dad966f070421b2343eade09d9eb516a172ee4872a82ab16cdfef96191d17b37542f6e72d68ec29c7a91dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe

Filesize
468KB

MD5
dd21752d8b86d8da8054bc6f0d875957

SHA1
e2f90044e8a7140880416f225a0258cf8e8efd71

SHA256
93b1669f6c29544ab7ebebcd0437353775ddb0cb49a7503391db272742673a58

SHA512
8e40d274f37cc4564377554af528ffbd5c9c20f1a0e69e482f3b74777a9c965a3641828f153364e0aac43302c906aa970fd4527fc52d0ef8a203acde3bf61407

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61388.exe

Filesize
468KB

MD5
ffc725e35c8c782f28289cc4a4c86aa3

SHA1
c8d93b49cc99f6ea7f43c284c819d90ca24b72ad

SHA256
e1871485674b22eb906a9352ed1554e571c0a0449a5902ca6beb8b17f42a2296

SHA512
7e9bf36db5ee0245a8b629b6ad0b1568386a6da0a56e127325efb1435f2e5af9abd78fc095dfb3373c3d46e446186d69a3007e81e8ee90773d964f002537d3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe

Filesize
468KB

MD5
ff2289e94a1e9ab002897ed6c3b10615

SHA1
413915ebb0e5ee4ad5d1b6e3198ae00bc78471c9

SHA256
4ebc15fe89a55e3b4cc9172bb6d77e05ddfbf28090b71a355db3dfaeed16e4e9

SHA512
7c5bedbf3569465833c8a1fc976c0b02e7599983a86edd1d5c11afe8f44b6eb0759a253712cb0813fc858b9d2b91016a88ed7a4d8b23ee01c648e11e37c61d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe

Filesize
468KB

MD5
ef87610cd5ab3e4e04e54885cf4fe21f

SHA1
fd461fca2c677b1f0057be5639eb3aaf9e878913

SHA256
640bbd04146d541ed7376e8d0be03c2450fbab71aa46d8acb3fd93c863970c4e

SHA512
213cd20b91914b6ef6d4c67f719cec892b46b8112a48c74ad94e25079735872ec1f261191a6f37d622680fa4b437c19d582a38e5ee94ac1be72082ed79b27851

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe

Filesize
468KB

MD5
b307c9727ca94d067f9875ebfdc78072

SHA1
f3b5ddacb8dcd6cf65fd7bc4085fd4402f4d05e3

SHA256
15f7af3c1667fec6fd188830cdf123008b662740d7b4f0ba29630add8d7267f4

SHA512
a59c73ef26c9e4317369c11db40806b960296e37ce636c2b71f60ca6af5b0d351308030f9ad152a75fc5f56c14678b5ce2fa95e4fec44acd5f818743dafe7237

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe

Filesize
468KB

MD5
bddb2579a3ee59a7a61028bd8dba63ce

SHA1
abcf53f05fd3b48329b6e8a90803d367c1b40665

SHA256
3778700c6983cd36241c1843db1d07dfb25a5522512cf17d916633fcb82976ac

SHA512
453e7da1a0917cfd11dc6ce7ed48dcb3725a55e3809b23dc6cc5f123c0dc3b256a36b491088ee0ff950730bea01ad73f659f9ec1700c5290c797bd4490a439f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe

Filesize
468KB

MD5
dad6c80f16f2a365de73a76dd272601a

SHA1
8a6f56f0c14971d91a575e81066555312dc8d8b2

SHA256
53cab6cd49ad9eb29b15983dbafb69aa26920dc19017815bd1f1f912d34b0057

SHA512
43b58059c67a67ed4e72f2912a073d9d80c4f71f57643cc7a4b81778017d748e6ea4cfbca34647401f5107c725dcc7c1b249823a53c62f168283522867dc3e18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe

Filesize
468KB

MD5
da96cbaac4bcb1f286476476a6f13cea

SHA1
eba3ee27eea03e0a739ed122eb7f9ed9f8425209

SHA256
cbed24db9c5a8c020a5a9e60f444df4fb1685f0937b327953dbdf0cf9ce20375

SHA512
5b677c087ccca5463d557ec03320c7b687097dbb1e1aba7d22e7d2aac36f7ce3a13bd5d99ed77f3cc58971bcf984b9d62dbeda794ee34f2c651b157a92481d77

Download Submit