55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
Size 468KB
Sample240929-l3sg4sseqc
SHA256 55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71
MD5 ca486d4ae7a66239fd35e8d669348420
SHA1 698684eaddce025e390c79bf2c06cefd8cef9a07
SHA512 4bda8de859da0cf0e6723f065cd1452c0cc13e975151431f46c2830820b9a0d1a2a7d298ec47be745af2993f230580709307bd72c9eb8eefd8dbe690b79eb1ac
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeL57ggUql7:6G3obKTtxH4OcfjY1IKkgNggU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1572	Unicorn-43638.exe
2264	Unicorn-17162.exe
1436	Unicorn-17716.exe
2228	Unicorn-11069.exe
2560	Unicorn-52657.exe
3912	Unicorn-31490.exe
4512	Unicorn-25359.exe
3240	Unicorn-22886.exe
5064	Unicorn-23440.exe
3336	Unicorn-63726.exe
4428	Unicorn-39776.exe
4860	Unicorn-59642.exe
4960	Unicorn-12479.exe
1416	Unicorn-14525.exe
1400	Unicorn-10176.exe
2324	Unicorn-12709.exe
1988	Unicorn-25516.exe
3664	Unicorn-53358.exe
3804	Unicorn-39060.exe
4052	Unicorn-20494.exe
4896	Unicorn-31983.exe
704	Unicorn-36830.exe
3204	Unicorn-32746.exe
2192	Unicorn-51120.exe
5088	Unicorn-33300.exe
2500	Unicorn-44998.exe
4288	Unicorn-1152.exe
1676	Unicorn-6056.exe
4320	Unicorn-25922.exe
3836	Unicorn-1972.exe
3788	Unicorn-47686.exe
1420	Unicorn-48241.exe
732	Unicorn-14821.exe
640	Unicorn-33195.exe
4720	Unicorn-20058.exe
3544	Unicorn-60898.exe
3312	Unicorn-7156.exe
1956	Unicorn-53093.exe
804	Unicorn-36564.exe
1916	Unicorn-23566.exe
740	Unicorn-23566.exe
2300	Unicorn-39902.exe
2104	Unicorn-4489.exe
1432	Unicorn-63896.exe
512	Unicorn-50161.exe
2068	Unicorn-24910.exe
3584	Unicorn-16742.exe
2372	Unicorn-16742.exe
4532	Unicorn-21380.exe
4324	Unicorn-33078.exe
3168	Unicorn-57582.exe
1840	Unicorn-37716.exe
2336	Unicorn-47368.exe
2120	Unicorn-23948.exe
3284	Unicorn-8116.exe
3772	Unicorn-49969.exe
5032	Unicorn-63704.exe
404	Unicorn-60904.exe
3024	Unicorn-33462.exe
3936	Unicorn-34016.exe
5004	Unicorn-49798.exe
2160	Unicorn-23055.exe
4464	Unicorn-45522.exe
4664	Unicorn-33270.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1428	4860	WerFault.exe	97
4784	4860	WerFault.exe	97
4248	3804	WerFault.exe	107
4188	3804	WerFault.exe	107
4544	4320	WerFault.exe	118
3700	4320	WerFault.exe	118
2172	2500	WerFault.exe	114
4268	2500	WerFault.exe	114
5480	4532	WerFault.exe	146
428	3284	WerFault.exe	153
6904	1840	WerFault.exe	149
5908	1812	WerFault.exe	178
6956	2372	WerFault.exe	145
6828	1416	WerFault.exe	99
5540	1916	WerFault.exe	137
5736	404	WerFault.exe	156
8984	5860	WerFault.exe	230
8892	6068	WerFault.exe	262
10160	7008	WerFault.exe	358
8796	5380	WerFault.exe	364
6820	3232	WerFault.exe	360
9248	6656	WerFault.exe	281
10204	5756	WerFault.exe	224
9472	5708	WerFault.exe	253
10200	1996	WerFault.exe	198
9396	5972	WerFault.exe	234
9540	5880	WerFault.exe	231
9960	5396	WerFault.exe	212
9668	1860	WerFault.exe	241
2336	1736	WerFault.exe	368
10148	228	WerFault.exe	321
10128	644	WerFault.exe	331
10120	6636	WerFault.exe	319
10100	5628	WerFault.exe	370
10092	3584	WerFault.exe	388
10084	6104	WerFault.exe	365
10076	4268	WerFault.exe	320
9976	7160	WerFault.exe	377
9804	6692	WerFault.exe	283
9292	3060	WerFault.exe	201
9724	6964	WerFault.exe	292
9824	5244	WerFault.exe	209
2028	5384	WerFault.exe	250
9608	5224	WerFault.exe	260
8788	6844	WerFault.exe	289
4784	5992	WerFault.exe	258
9692	5092	WerFault.exe	263
9580	1712	WerFault.exe	200
10372	4820	WerFault.exe	394
10548	5228	WerFault.exe	397
10540	2592	WerFault.exe	396
10532	3936	WerFault.exe	379
10524	6552	WerFault.exe	400
10516	3148	WerFault.exe	387
10508	7388	WerFault.exe	421
10500	7756	WerFault.exe	435
10492	7624	WerFault.exe	429
10484	6580	WerFault.exe	376
10364	5528	WerFault.exe	398
10356	6912	WerFault.exe	408
10600	1840	WerFault.exe	384
10576	3204	WerFault.exe	405
10692	5888	WerFault.exe	232
2304	7780	WerFault.exe	440

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30559.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
1572	Unicorn-43638.exe
2264	Unicorn-17162.exe
1436	Unicorn-17716.exe
2228	Unicorn-11069.exe
2560	Unicorn-52657.exe
3912	Unicorn-31490.exe
4512	Unicorn-25359.exe
3240	Unicorn-22886.exe
5064	Unicorn-23440.exe
1400	Unicorn-10176.exe
4428	Unicorn-39776.exe
3336	Unicorn-63726.exe
4960	Unicorn-12479.exe
1416	Unicorn-14525.exe
4860	Unicorn-59642.exe
2324	Unicorn-12709.exe
1988	Unicorn-25516.exe
3664	Unicorn-53358.exe
3804	Unicorn-39060.exe
4052	Unicorn-20494.exe
3204	Unicorn-32746.exe
704	Unicorn-36830.exe
4896	Unicorn-31983.exe
4320	Unicorn-25922.exe
2500	Unicorn-44998.exe
2192	Unicorn-51120.exe
4288	Unicorn-1152.exe
1676	Unicorn-6056.exe
3836	Unicorn-1972.exe
5088	Unicorn-33300.exe
3788	Unicorn-47686.exe
1420	Unicorn-48241.exe
732	Unicorn-14821.exe
640	Unicorn-33195.exe
4720	Unicorn-20058.exe
3544	Unicorn-60898.exe
1956	Unicorn-53093.exe
3312	Unicorn-7156.exe
804	Unicorn-36564.exe
740	Unicorn-23566.exe
1916	Unicorn-23566.exe
2300	Unicorn-39902.exe
1432	Unicorn-63896.exe
512	Unicorn-50161.exe
2104	Unicorn-4489.exe
3584	Unicorn-16742.exe
2068	Unicorn-24910.exe
4532	Unicorn-21380.exe
4324	Unicorn-33078.exe
2372	Unicorn-16742.exe
3168	Unicorn-57582.exe
3284	Unicorn-8116.exe
3772	Unicorn-49969.exe
1840	Unicorn-37716.exe
404	Unicorn-60904.exe
2336	Unicorn-47368.exe
2120	Unicorn-23948.exe
5032	Unicorn-63704.exe
3024	Unicorn-33462.exe
5004	Unicorn-49798.exe
3936	Unicorn-34016.exe
2160	Unicorn-23055.exe
4464	Unicorn-45522.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1572	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	82
PID 4972 wrote to memory of 1572	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	82
PID 4972 wrote to memory of 1572	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	82
PID 1572 wrote to memory of 2264	1572	Unicorn-43638.exe	83
PID 1572 wrote to memory of 2264	1572	Unicorn-43638.exe	83
PID 1572 wrote to memory of 2264	1572	Unicorn-43638.exe	83
PID 4972 wrote to memory of 1436	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	84
PID 4972 wrote to memory of 1436	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	84
PID 4972 wrote to memory of 1436	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	84
PID 2264 wrote to memory of 2228	2264	Unicorn-17162.exe	87
PID 2264 wrote to memory of 2228	2264	Unicorn-17162.exe	87
PID 2264 wrote to memory of 2228	2264	Unicorn-17162.exe	87
PID 1572 wrote to memory of 2560	1572	Unicorn-43638.exe	88
PID 1572 wrote to memory of 2560	1572	Unicorn-43638.exe	88
PID 1572 wrote to memory of 2560	1572	Unicorn-43638.exe	88
PID 1436 wrote to memory of 3912	1436	Unicorn-17716.exe	89
PID 1436 wrote to memory of 3912	1436	Unicorn-17716.exe	89
PID 1436 wrote to memory of 3912	1436	Unicorn-17716.exe	89
PID 4972 wrote to memory of 4512	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	90
PID 4972 wrote to memory of 4512	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	90
PID 4972 wrote to memory of 4512	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	90
PID 2228 wrote to memory of 3240	2228	Unicorn-11069.exe	93
PID 2228 wrote to memory of 3240	2228	Unicorn-11069.exe	93
PID 2228 wrote to memory of 3240	2228	Unicorn-11069.exe	93
PID 2264 wrote to memory of 5064	2264	Unicorn-17162.exe	94
PID 2264 wrote to memory of 5064	2264	Unicorn-17162.exe	94
PID 2264 wrote to memory of 5064	2264	Unicorn-17162.exe	94
PID 3912 wrote to memory of 3336	3912	Unicorn-31490.exe	95
PID 3912 wrote to memory of 3336	3912	Unicorn-31490.exe	95
PID 3912 wrote to memory of 3336	3912	Unicorn-31490.exe	95
PID 1436 wrote to memory of 4428	1436	Unicorn-17716.exe	96
PID 1436 wrote to memory of 4428	1436	Unicorn-17716.exe	96
PID 1436 wrote to memory of 4428	1436	Unicorn-17716.exe	96
PID 2560 wrote to memory of 4860	2560	Unicorn-52657.exe	97
PID 2560 wrote to memory of 4860	2560	Unicorn-52657.exe	97
PID 2560 wrote to memory of 4860	2560	Unicorn-52657.exe	97
PID 1572 wrote to memory of 4960	1572	Unicorn-43638.exe	98
PID 1572 wrote to memory of 4960	1572	Unicorn-43638.exe	98
PID 1572 wrote to memory of 4960	1572	Unicorn-43638.exe	98
PID 4512 wrote to memory of 1416	4512	Unicorn-25359.exe	99
PID 4512 wrote to memory of 1416	4512	Unicorn-25359.exe	99
PID 4512 wrote to memory of 1416	4512	Unicorn-25359.exe	99
PID 4972 wrote to memory of 1400	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	100
PID 4972 wrote to memory of 1400	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	100
PID 4972 wrote to memory of 1400	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	100
PID 3240 wrote to memory of 2324	3240	Unicorn-22886.exe	102
PID 3240 wrote to memory of 2324	3240	Unicorn-22886.exe	102
PID 3240 wrote to memory of 2324	3240	Unicorn-22886.exe	102
PID 2228 wrote to memory of 1988	2228	Unicorn-11069.exe	105
PID 2228 wrote to memory of 1988	2228	Unicorn-11069.exe	105
PID 2228 wrote to memory of 1988	2228	Unicorn-11069.exe	105
PID 5064 wrote to memory of 3664	5064	Unicorn-23440.exe	106
PID 5064 wrote to memory of 3664	5064	Unicorn-23440.exe	106
PID 5064 wrote to memory of 3664	5064	Unicorn-23440.exe	106
PID 2264 wrote to memory of 3804	2264	Unicorn-17162.exe	107
PID 2264 wrote to memory of 3804	2264	Unicorn-17162.exe	107
PID 2264 wrote to memory of 3804	2264	Unicorn-17162.exe	107
PID 1400 wrote to memory of 4052	1400	Unicorn-10176.exe	108
PID 1400 wrote to memory of 4052	1400	Unicorn-10176.exe	108
PID 1400 wrote to memory of 4052	1400	Unicorn-10176.exe	108
PID 4972 wrote to memory of 4896	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	109
PID 4972 wrote to memory of 4896	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	109
PID 4972 wrote to memory of 4896	4972	55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe	109
PID 4428 wrote to memory of 704	4428	Unicorn-39776.exe	110

C:\Users\Admin\AppData\Local\Temp\55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe
"C:\Users\Admin\AppData\Local\Temp\55b87943b36160fc3a1db751c1aa9f515d2b6fd43948d5d02f839afba1ecda71N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        9⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        10⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 636
        11⤵
        Program crash
        
        PID:9804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 628
        10⤵
        Program crash
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
        9⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29918.exe
        10⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16338.exe
        11⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
        12⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        11⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        10⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        11⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
        12⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44248.exe
        11⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9919.exe
        10⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
        11⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
        11⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13803.exe
        9⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9513.exe
        10⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8052.exe
        10⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
        9⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        9⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        9⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29726.exe
        9⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        9⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 636
        10⤵
        Program crash
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19703.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32326.exe
        9⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36626.exe
        11⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53761.exe
        10⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7299.exe
        10⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        9⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 756
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34016.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30559.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9549.exe
        9⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47370.exe
        10⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        11⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 636
        11⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        9⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        9⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40954.exe
        10⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28540.exe
        10⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55681.exe
        9⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21499.exe
        9⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13044.exe
        9⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23442.exe
        9⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 648
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        8⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        9⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 504
        8⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23810.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13005.exe
        9⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 716
        10⤵
        Program crash
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38464.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
        9⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        8⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 652
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43160.exe
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        9⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        9⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40509.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        7⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 632
        8⤵
        Program crash
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46721.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        8⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 668
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
        7⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34358.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24456.exe
        8⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24980.exe
        7⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14821.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55714.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 652
        9⤵
        Program crash
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22356.exe
        8⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45310.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        11⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        10⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27529.exe
        10⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 656
        9⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        8⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7852 -s 636
        9⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        8⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 636
        8⤵
        Program crash
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        7⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 636
        8⤵
        Program crash
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37837.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        9⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2032.exe
        7⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        6⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33270.exe
        6⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61386.exe
        7⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41328.exe
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15427.exe
        6⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 720
        7⤵
        Program crash
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53981.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        5⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33568.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        7⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3148.exe
        6⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        7⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29742.exe
        9⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8848 -s 636
        10⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 632
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42636.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        7⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
        6⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7092.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
        8⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59328.exe
        7⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        5⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12877.exe
        5⤵
        
        PID:8144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8144 -s 640
        6⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22543.exe
        5⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        6⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4240.exe
        5⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        6⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20058.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16632.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35694.exe
        10⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56742.exe
        11⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54394.exe
        12⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        11⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39180.exe
        10⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29698.exe
        11⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13636.exe
        11⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24234.exe
        12⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20407.exe
        11⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        11⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50184.exe
        10⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33865.exe
        10⤵
        
        PID:14468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6844 -s 736
        9⤵
        Program crash
        
        PID:8788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 660
        8⤵
        Program crash
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        7⤵
        
        PID:228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 628
        8⤵
        Program crash
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8952.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
        8⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 720
        8⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 504
        7⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        6⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        7⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 636
        8⤵
        Program crash
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30175.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        7⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        6⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21786.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13124.exe
        6⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20930.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        8⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 660
        8⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1988.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9705.exe
        8⤵
        
        PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 632
        5⤵
        Program crash
        
        PID:4248
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 632
        5⤵
        Program crash
        
        PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        5⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-893.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32362.exe
        7⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 632
        7⤵
        Program crash
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60390.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        8⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7280 -s 636
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7668.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19831.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27748.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22106.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3356.exe
        7⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64540.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        6⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        5⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 612
        7⤵
        Program crash
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20186.exe
        6⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        8⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39460.exe
        5⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        6⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65126.exe
        6⤵
        
        PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
      4⤵
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64178.exe
        5⤵
        
        PID:3232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 632
        6⤵
        Program crash
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        5⤵
        
        PID:8420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8420 -s 636
        6⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        5⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        6⤵
        
        PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
      4⤵
      PID:6580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6580 -s 636
        5⤵
        Program crash
        
        PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        5⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41072.exe
        5⤵
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
      4⤵
      PID:13220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 728
        5⤵
        Program crash
        
        PID:1428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 728
        5⤵
        Program crash
        
        PID:4784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25834.exe
        7⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7608 -s 636
        8⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        6⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63974.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
        6⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36092.exe
        5⤵
        
        PID:6636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 604
        6⤵
        Program crash
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4868.exe
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        6⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        7⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        6⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        5⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36678.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63704.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9253.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
        5⤵
        
        PID:6656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 636
        6⤵
        Program crash
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
        5⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        6⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        7⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56485.exe
        6⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6797.exe
        8⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        6⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58397.exe
        5⤵
        
        PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        5⤵
        
        PID:15320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27178.exe
        6⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55050.exe
        8⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 740
        8⤵
        Program crash
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9985.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        9⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        10⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8208.exe
        9⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 752
        8⤵
        
        PID:13392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 756
        5⤵
        Program crash
        
        PID:2172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 756
        5⤵
        Program crash
        
        PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 644
        5⤵
        Program crash
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      4⤵
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47930.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        6⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7756 -s 636
        7⤵
        Program crash
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34166.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        7⤵
        
        PID:14008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 624
        5⤵
        Program crash
        
        PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
      4⤵
      PID:4268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 644
        5⤵
        Program crash
        
        PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
      4⤵
      PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
        5⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        6⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        5⤵
        
        PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27200.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31594.exe
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        5⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        6⤵
        
        PID:5184
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 712
        5⤵
        Program crash
        
        PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60904.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 644
      4⤵
      Program crash
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59465.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44422.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55730.exe
        5⤵
        
        PID:7696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 636
        6⤵
        
        PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42260.exe
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
      4⤵
      PID:13352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17898.exe
        5⤵
        
        PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
    3⤵
    PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
      4⤵
      PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50546.exe
        5⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
      4⤵
      PID:9744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44823.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 752
    3⤵
    PID:11676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24910.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42502.exe
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        9⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 636
        10⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 756
        9⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        8⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
        8⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 712
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38972.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64628.exe
        7⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 720
        8⤵
        Program crash
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49969.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51978.exe
        9⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        9⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24270.exe
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        9⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        10⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60201.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14965.exe
        9⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49454.exe
        8⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        9⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        7⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62621.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        7⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8112 -s 636
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        9⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52785.exe
        6⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
        8⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5599.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18782.exe
        7⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7764 -s 720
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23664.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47321.exe
        8⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50762.exe
        8⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1220.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8509.exe
        7⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        7⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        6⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36574.exe
        7⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        7⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35974.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7681.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60997.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14773.exe
        9⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        7⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51573.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14823.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44581.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4499.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9052 -s 636
        7⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63028.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3216.exe
        6⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58443.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        5⤵
        
        PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44090.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        7⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 636
        8⤵
        Program crash
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63012.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30357.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20835.exe
        7⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3751.exe
        6⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7388 -s 628
        7⤵
        Program crash
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        6⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
        7⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        7⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6792 -s 652
        7⤵
        
        PID:11600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 664
        6⤵
        Program crash
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        6⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7624 -s 636
        7⤵
        Program crash
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24506.exe
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        7⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34599.exe
        5⤵
        
        PID:9948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 660
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      4⤵
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48506.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56114.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        7⤵
        
        PID:1756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 756
        6⤵
        
        PID:9860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 660
        5⤵
        Program crash
        
        PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29591.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        5⤵
        
        PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35130.exe
      4⤵
      PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62038.exe
        6⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35386.exe
        7⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40356.exe
        5⤵
        
        PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
      4⤵
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
        5⤵
        
        PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
      4⤵
      PID:14636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        6⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 716
        7⤵
        Program crash
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14977.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 724
        8⤵
        Program crash
        
        PID:8796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 664
        7⤵
        Program crash
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7312.exe
        5⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31314.exe
        7⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 720
        8⤵
        Program crash
        
        PID:10084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 740
        7⤵
        Program crash
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        6⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 636
        7⤵
        Program crash
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31971.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        7⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28769.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        5⤵
        
        PID:6068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 628
        6⤵
        Program crash
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23198.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50865.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
        5⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20447.exe
        5⤵
        
        PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        5⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1277.exe
        6⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        6⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        7⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23237.exe
        5⤵
        
        PID:11116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11116 -s 636
        6⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59268.exe
        5⤵
        
        PID:13248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
      4⤵
      PID:5236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 644
      4⤵
      Program crash
      PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41452.exe
    3⤵
    PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
    3⤵
    PID:7160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 640
      4⤵
      Program crash
      PID:9976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32571.exe
    3⤵
    PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
      4⤵
      PID:3700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
    3⤵
    PID:10772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
    3⤵
    PID:1264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 640
        5⤵
        Program crash
        
        PID:4544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 640
        5⤵
        Program crash
        
        PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 628
        5⤵
        Program crash
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21431.exe
      4⤵
      PID:5228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 736
      4⤵
      Program crash
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        5⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43621.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
        9⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20128.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        9⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17371.exe
        7⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11084 -s 640
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53825.exe
        6⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 724
        7⤵
        Program crash
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
        8⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45516.exe
        6⤵
        
        PID:13412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 712
        5⤵
        Program crash
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48153.exe
      4⤵
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16654.exe
        5⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50893.exe
        5⤵
        
        PID:5228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 644
        6⤵
        Program crash
        
        PID:10548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 716
        5⤵
        
        PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22775.exe
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        5⤵
        
        PID:1736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 632
        6⤵
        Program crash
        
        PID:2336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 636
        5⤵
        Program crash
        
        PID:9692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63896.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19128.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
      4⤵
      PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        5⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        6⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36464.exe
        5⤵
        
        PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46344.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
        5⤵
        
        PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54096.exe
    3⤵
    PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24594.exe
      4⤵
      PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
        5⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15874.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        5⤵
        
        PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52445.exe
      4⤵
      PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        5⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
        5⤵
        
        PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
      4⤵
      PID:12100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
    3⤵
    PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
      4⤵
      PID:11540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29274.exe
    3⤵
    PID:9480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9480 -s 636
      4⤵
      PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
    3⤵
    PID:4016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 636
        7⤵
        Program crash
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33404.exe
        6⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 636
        7⤵
        Program crash
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60094.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1220.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16102.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
        7⤵
        
        PID:8024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6080 -s 656
        6⤵
        
        PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
      4⤵
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
      4⤵
      PID:6552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 636
        5⤵
        Program crash
        
        PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54969.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9009.exe
      4⤵
      PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34230.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63794.exe
        6⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 632
        7⤵
        Program crash
        
        PID:10100
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 724
        6⤵
        Program crash
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34364.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45458.exe
        7⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1959.exe
        6⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        5⤵
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
      4⤵
      PID:6040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56688.exe
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49710.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27422.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
        5⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        6⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8800 -s 636
        7⤵
        
        PID:13632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 660
        5⤵
        
        PID:12440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20472.exe
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12627.exe
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
      4⤵
      PID:6008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 640
        5⤵
        
        PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11176.exe
      4⤵
      PID:12216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
    3⤵
    PID:8940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
    3⤵
    PID:9664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52143.exe
    3⤵
    PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
      4⤵
      PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62533.exe
    3⤵
    PID:6196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4489.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38854.exe
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        
        PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14468.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        6⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13112.exe
        6⤵
        
        PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36616.exe
      4⤵
      PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58065.exe
      4⤵
      PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11773.exe
        5⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2521.exe
        6⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10756.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        5⤵
        
        PID:15308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
    3⤵
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53538.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19884.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        6⤵
        
        PID:8244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 540
      4⤵
      PID:10916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
    3⤵
    PID:7744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22739.exe
    3⤵
    PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
      4⤵
      PID:14132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
    3⤵
    PID:12308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23948.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2813.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        5⤵
        
        PID:8160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8160 -s 636
        6⤵
        
        PID:10396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6756 -s 656
        5⤵
        
        PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54889.exe
      4⤵
      PID:8216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8216 -s 636
        5⤵
        
        PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2955.exe
      4⤵
      PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
    3⤵
    PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65522.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        5⤵
        
        PID:8908
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8908 -s 636
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        5⤵
        
        PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
      4⤵
      PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
    3⤵
    PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14837.exe
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3008.exe
      4⤵
      PID:12160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63301.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25998.exe
      4⤵
      PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        5⤵
        
        PID:15012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
    3⤵
    PID:12556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
  2⤵
  PID:5244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20110.exe
    3⤵
    PID:6964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 648
      4⤵
      Program crash
      PID:9724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 548
    3⤵
    - Program crash
    PID:9824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16183.exe
  2⤵
  PID:644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 632
    3⤵
    - Program crash
    PID:10128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
  2⤵
  PID:8400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39472.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
  2⤵
  PID:12840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4860 -ip 4860
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4860 -ip 4860
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3804 -ip 3804
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3804 -ip 3804
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4320 -ip 4320
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4320 -ip 4320
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2500 -ip 2500
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2500 -ip 2500
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4532 -ip 4532
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 404 -ip 404
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2336 -ip 2336
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3284 -ip 3284
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1432 -ip 1432
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3584 -ip 3584
1⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1840 -ip 1840
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3168 -ip 3168
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2560 -ip 2560
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4288 -ip 4288
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4428 -ip 4428
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3204 -ip 3204
1⤵
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3936 -ip 3936
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3468 -ip 3468
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1420 -ip 1420
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1432 -ip 1432
1⤵
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3168 -ip 3168
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3584 -ip 3584
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1840 -ip 1840
1⤵
PID:6388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 2336 -ip 2336
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4288 -ip 4288
1⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2560 -ip 2560
1⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3204 -ip 3204
1⤵
PID:6720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4428 -ip 4428
1⤵
PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3300 -ip 3300
1⤵
PID:6924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1812 -ip 1812
1⤵
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5064 -ip 5064
1⤵
PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2300 -ip 2300
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1916 -ip 1916
1⤵
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3936 -ip 3936
1⤵
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3468 -ip 3468
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1420 -ip 1420
1⤵
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2372 -ip 2372
1⤵
PID:6424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5228 -ip 5228
1⤵
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4440 -ip 4440
1⤵
PID:6464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4736 -ip 4736
1⤵
PID:6512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5236 -ip 5236
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5152 -ip 5152
1⤵
PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3108 -ip 3108
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3300 -ip 3300
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1812 -ip 1812
1⤵
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5064 -ip 5064
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2300 -ip 2300
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1916 -ip 1916
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1416 -ip 1416
1⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2192 -ip 2192
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5228 -ip 5228
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2372 -ip 2372
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4440 -ip 4440
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4736 -ip 4736
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5152 -ip 5152
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 5236 -ip 5236
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3108 -ip 3108
1⤵
PID:6268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4532 -ip 4532
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 404 -ip 404
1⤵
PID:6260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2192 -ip 2192
1⤵
PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3284 -ip 3284
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 5192 -ip 5192
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5260 -ip 5260
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5688 -ip 5688
1⤵
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5840 -ip 5840
1⤵
PID:6436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5712 -ip 5712
1⤵
PID:6580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5980 -ip 5980
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 748 -ip 748
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 5576 -ip 5576
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6052 -ip 6052
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5128 -ip 5128
1⤵
PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5964 -ip 5964
1⤵
PID:6908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 6212 -ip 6212
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 5784 -ip 5784
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5816 -ip 5816
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6032 -ip 6032
1⤵
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5388 -ip 5388
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5184 -ip 5184
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5652 -ip 5652
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5860 -ip 5860
1⤵
PID:7200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 6068 -ip 6068
1⤵
PID:7280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6040 -ip 6040
1⤵
PID:7360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5192 -ip 5192
1⤵
PID:7424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 5260 -ip 5260
1⤵
PID:7484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5840 -ip 5840
1⤵
PID:7548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5712 -ip 5712
1⤵
PID:7556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5980 -ip 5980
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5688 -ip 5688
1⤵
PID:7640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3836 -ip 3836
1⤵
PID:7708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4792 -ip 4792
1⤵
PID:7828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 1428 -ip 1428
1⤵
PID:7904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1508 -ip 1508
1⤵
PID:7992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 3752 -ip 3752
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1552 -ip 1552
1⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2324 -ip 2324
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4900 -ip 4900
1⤵
PID:7536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1424 -ip 1424
1⤵
PID:7488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 5888 -ip 5888
1⤵
PID:7688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4468 -ip 4468
1⤵
PID:7544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 4780 -ip 4780
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4664 -ip 4664
1⤵
PID:8104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 740 -ip 740
1⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3544 -ip 3544
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 880 -ip 880
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 1956 -ip 1956
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 1988 -ip 1988
1⤵
PID:8184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 804 -ip 804
1⤵
PID:8472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 748 -ip 748
1⤵
PID:8632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5576 -ip 5576
1⤵
PID:8720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 5128 -ip 5128
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 6052 -ip 6052
1⤵
PID:8812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5784 -ip 5784
1⤵
PID:8840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6212 -ip 6212
1⤵
PID:8924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5964 -ip 5964
1⤵
PID:9028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 5184 -ip 5184
1⤵
PID:9100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 6032 -ip 6032
1⤵
PID:7888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 5388 -ip 5388
1⤵
PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 5816 -ip 5816
1⤵
PID:7892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 5652 -ip 5652
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5860 -ip 5860
1⤵
PID:8288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 6068 -ip 6068
1⤵
PID:8372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6040 -ip 6040
1⤵
PID:8476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 7056 -ip 7056
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7052 -ip 7052
1⤵
PID:8888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6748 -ip 6748
1⤵
PID:8916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5568 -ip 5568
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6344 -ip 6344
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 6468 -ip 6468
1⤵
PID:7468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3136 -ip 3136
1⤵
PID:9060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6640 -ip 6640
1⤵
PID:9172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6484 -ip 6484
1⤵
PID:8852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 6864 -ip 6864
1⤵
PID:8352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6088 -ip 6088
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6692 -ip 6692
1⤵
PID:9028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 6964 -ip 6964
1⤵
PID:7236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7160 -ip 7160
1⤵
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3836 -ip 3836
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 4792 -ip 4792
1⤵
PID:8712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3584 -ip 3584
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6104 -ip 6104
1⤵
PID:9392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4268 -ip 4268
1⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5628 -ip 5628
1⤵
PID:9476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 644 -ip 644
1⤵
PID:9492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 6636 -ip 6636
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 3232 -ip 3232
1⤵
PID:9700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7008 -ip 7008
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 228 -ip 228
1⤵
PID:9820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 1736 -ip 1736
1⤵
PID:10000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5380 -ip 5380
1⤵
PID:10008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 6656 -ip 6656
1⤵
PID:10060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1428 -ip 1428
1⤵
PID:9404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1508 -ip 1508
1⤵
PID:9416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 3752 -ip 3752
1⤵
PID:9332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 1860 -ip 1860
1⤵
PID:9576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1552 -ip 1552
1⤵
PID:9500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5396 -ip 5396
1⤵
PID:9508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5880 -ip 5880
1⤵
PID:10028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5972 -ip 5972
1⤵
PID:10044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1996 -ip 1996
1⤵
PID:10060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5708 -ip 5708
1⤵
PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4900 -ip 4900
1⤵
PID:5816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 1424 -ip 1424
1⤵
PID:9708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 2324 -ip 2324
1⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4780 -ip 4780
1⤵
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5756 -ip 5756
1⤵
PID:9820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5888 -ip 5888
1⤵
PID:8936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4468 -ip 4468
1⤵
PID:9856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3060 -ip 3060
1⤵
PID:10252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1712 -ip 1712
1⤵
PID:10344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5092 -ip 5092
1⤵
PID:10404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 5992 -ip 5992
1⤵
PID:10448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 6844 -ip 6844
1⤵
PID:10456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5224 -ip 5224
1⤵
PID:10464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 5384 -ip 5384
1⤵
PID:10564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5244 -ip 5244
1⤵
PID:10640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4664 -ip 4664
1⤵
PID:10700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 3544 -ip 3544
1⤵
PID:10760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 740 -ip 740
1⤵
PID:10916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1956 -ip 1956
1⤵
PID:10964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 880 -ip 880
1⤵
PID:11044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1988 -ip 1988
1⤵
PID:11212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 804 -ip 804
1⤵
PID:10288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 6912 -ip 6912
1⤵
PID:10000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5528 -ip 5528
1⤵
PID:10468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4820 -ip 4820
1⤵
PID:10460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 6580 -ip 6580
1⤵
PID:10312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 7624 -ip 7624
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 7388 -ip 7388
1⤵
PID:10796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 7756 -ip 7756
1⤵
PID:10972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3148 -ip 3148
1⤵
PID:11296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 6552 -ip 6552
1⤵
PID:11684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3936 -ip 3936
1⤵
PID:11800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2592 -ip 2592
1⤵
PID:11904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5228 -ip 5228
1⤵
PID:12240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3204 -ip 3204
1⤵
PID:9716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1840 -ip 1840
1⤵
PID:10452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 7216 -ip 7216
1⤵
PID:12060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7696 -ip 7696
1⤵
PID:12408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7764 -ip 7764
1⤵
PID:12696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 8160 -ip 8160
1⤵
PID:12940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 7780 -ip 7780
1⤵
PID:13092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7608 -ip 7608
1⤵
PID:13184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 7808 -ip 7808
1⤵
PID:13192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 7056 -ip 7056
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 6748 -ip 6748
1⤵
PID:12836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6852 -ip 6852
1⤵
PID:11332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8084 -ip 8084
1⤵
PID:13164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 8152 -ip 8152
1⤵
PID:13260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 7052 -ip 7052
1⤵
PID:10312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 5568 -ip 5568
1⤵
PID:12712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 8024 -ip 8024
1⤵
PID:12148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7928 -ip 7928
1⤵
PID:12424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 3136 -ip 3136
1⤵
PID:12364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 6640 -ip 6640
1⤵
PID:13184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 6468 -ip 6468
1⤵
PID:12304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 6344 -ip 6344
1⤵
PID:13100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 8112 -ip 8112
1⤵
PID:11688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 344 -ip 344
1⤵
PID:12948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 4912 -ip 4912
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 3456 -ip 3456
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6484 -ip 6484
1⤵
PID:13372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6864 -ip 6864
1⤵
PID:13404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 7016 -ip 7016
1⤵
PID:13548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6088 -ip 6088
1⤵
PID:13556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5680 -ip 5680
1⤵
PID:13684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 1416 -ip 1416
1⤵
PID:13740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 2068 -ip 2068
1⤵
PID:13748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 3788 -ip 3788
1⤵
PID:13756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6756 -ip 6756
1⤵
PID:14012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3468 -ip 3468
1⤵
PID:14020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1432 -ip 1432
1⤵
PID:14124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 5620 -ip 5620
1⤵
PID:14208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1284 -p 2668 -ip 2668
1⤵
PID:14216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 5876 -ip 5876
1⤵
PID:14224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 5580 -ip 5580
1⤵
PID:11516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 6792 -ip 6792
1⤵
PID:11044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5196 -ip 5196
1⤵
PID:13564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 6572 -ip 6572
1⤵
PID:13556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5804 -ip 5804
1⤵
PID:14004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6604 -ip 6604
1⤵
PID:14032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6512 -ip 6512
1⤵
PID:13744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 5584 -ip 5584
1⤵
PID:14016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5676 -ip 5676
1⤵
PID:13520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5472 -ip 5472
1⤵
PID:6724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 8144 -ip 8144
1⤵
PID:15348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1384 -p 7852 -ip 7852
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 10872 -ip 10872
1⤵
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 10932 -ip 10932
1⤵
PID:14828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 11084 -ip 11084
1⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 9480 -ip 9480
1⤵
PID:9844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7556 -ip 7556
1⤵
PID:15160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11116 -ip 11116
1⤵
PID:9980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1416 -p 11112 -ip 11112
1⤵
PID:10184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 11056 -ip 11056
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 11592 -ip 11592
1⤵
PID:8384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1132 -p 3700 -ip 3700
1⤵
PID:428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 11472 -ip 11472
1⤵
PID:9020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 804 -ip 804
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 11152 -ip 11152
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 11096 -ip 11096
1⤵
PID:9904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 11048 -ip 11048
1⤵
PID:7480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 10772 -ip 10772
1⤵
PID:9244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 8204 -ip 8204
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 8312 -ip 8312
1⤵
PID:6888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 5528 -ip 5528
1⤵
PID:10340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4464 -ip 4464
1⤵
PID:12584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5144 -ip 5144
1⤵
PID:6780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 14008 -ip 14008
1⤵
PID:8616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5748 -ip 5748
1⤵
PID:8200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 2956 -ip 2956
1⤵
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 2160 -ip 2160
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 13288 -ip 13288
1⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1432 -p 5480 -ip 5480
1⤵
PID:6472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1460 -p 7372 -ip 7372
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 10800 -ip 10800
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10176.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
Size 468KB
SHA256 550785ab1e87e81f5e4f566720b143215ff7370dbf457ede3360171192fc8e33
MD5 de5d67098ae21647e38f8a8c27a2192e
SHA1 92acc680fd324dd412d585365ca64accb5c5dd26
SHA512 9f2cce9bbbf2f566900682fa34d6969269b19c3271b113ad1675080ef983ab998d5e97c295c19ed807adce5067951c7f0fff42ce2d827d2d721a6c61a9e81fe5
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7SKkeL57ggUql7:6G3obKTtxH4OcfjY1oKkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11069.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
Size 468KB
SHA256 a5299cacaeae86425caea62c14da4dd37f850fa03d7472f39e6e2e4ed71272f2
MD5 63cc1b08e26883e067b00e49764cca6f
SHA1 03fa4e7200d2ba9eae48a3b869c40d08209d78b6
SHA512 dd61ea2592b979e79b2e239af47f16311017ee03f8f8ba421619fe8db068e444dc3f7d9bb9fd44705f278b4285cd46b18986e69efa35b9f8f123f8c751853894
SSDEEP 3072:6G3HogIS5EPTtbY2HzcO9f8/zCcap0pkJVHeTV7yKkeT57ggUql7:6G3oqKTtxH4O9fjY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1152.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1152.exe
Size 468KB
SHA256 b83d44c5f6566275f8891785fe140666bbc9b2e331f0d5042c27322c96f52794
MD5 d26fcaca495b7b8401667d9db61452fe
SHA1 f327d80f284b0eb376a9bf0af682e2a71c3e6ce9
SHA512 548730d3ad9be4de75d53abfaaecaee113f2666b160dc60851f633d2e02fff1ee77caa4eb2532ca22c43049191f690cbad8ffbd6597f4ee344d3b3666af727b3
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCmap0pkJVHeTV7yKkeT57ggUql7:6G3obKTtxH4OcfpY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12479.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
Size 468KB
SHA256 a049aa558973e27410eb4c955518216a8b2372be1b00b1baeac2c5c543546608
MD5 0bf0081360c475b5c5d2dc6217bdd744
SHA1 e76ac515967fc483d53f923c0af7b8e2b3ef4b65
SHA512 51e9046a8d2fa23b07ba4bef13aa374de6b9c904392185734afa8c4cb38cd313e6c4ae2d10e71eb1522d9d91aede5e21462ae0b0b1b36e62836c060d1331763e
SSDEEP 3072:UG3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeT57ggUql7:UG3obKTtxH4OcfjY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12709.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
Size 468KB
SHA256 c2230c5dce6647960642b4e6c0c0ee2aa68bcf5c24b7f01391de5df983044493
MD5 49847094d98e8a1bb73e80b05c69e018
SHA1 02931d1d7fabf03ef70a8bde0d42a99abccbeb68
SHA512 b0fe7b6fbbd6d69920882b0093804532e7f69fdd54c8f27bfe6b521c806bfcc08597f8a994230e03893d60d70d920a054ade0145a2dac189d18989c369cc9f0d
SSDEEP 3072:6G3HogIS5EPetbY2HzcO9f8/zCcap0fkJVHeTV7yKkeT57ggUql7:6G3oqKetxH4O9fji1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-14525.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
Size 468KB
SHA256 cb9501b7ea94530f7dc230aa35819a6426e1d7c33afeb7c8e39e81480bc43d1a
MD5 691d7e2786249c46d9cf6f20383a6eaf
SHA1 79729b72239e96284f3ae69ab7beafda5b49fa67
SHA512 59bd7c3ed49f2a1c79095ad06df9ebf81c286261b4151e751b49c707ec180fc4d957e002cb75ced359c54ce85ded768cfd820c3a7f6281f200412d882f844620
SSDEEP 3072:6G3HogISIEPTtbYMHzcOcf8/zncap0pkJVHeTV7yKkeL57ggUql7:6G3obKTtXH4OcfkY1IKkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17162.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
Size 468KB
SHA256 b8334d62df6c7163b5518a4fe257a3b6ce0d48a98617445cdd38407bc732cccb
MD5 499eda8ef91b9686ddf6ed49e6170fd2
SHA1 ce62eaed3d6170f61ab27124b8ebe83ffb3f625f
SHA512 5c1952d0df3a18c44a6cda2fd5213439256dbe42712ef2e2fdc8886c1b357a996888d48c1e59e397b155c4592d1adf6b28a08a0511f2f99a7e4d85de0f729a02
SSDEEP 3072:6G3HogISIEPTtbY2HzcO9f8/zCcap0pkJVHeTV7yKkeT57ggUql7:6G3obKTtxH4O9fjY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-17716.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-17716.exe
Size 468KB
SHA256 ec5bd9ba4fea43c003033a45b8940a31d8785366afecb91f92c9f357f4b67752
MD5 6099f0c61c180a1f12558dbb56caf04b
SHA1 cde2c5ecf0db77922d0122b128960deaec598123
SHA512 8234ad778f200581f1478da1c5835589b1ca73bc88a38c1e260ca9cb1119590d16c0549069d98fe4f70913d7191a6e009536264e29bb5d756ec6e0a56f21f463
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeL5nggUql7:6G3obKTtxH4OcfjY1IKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-1972.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1972.exe
Size 468KB
SHA256 ad8b7a0b6b98318aeb2024179f7ad0faae150b740abe8d6e949557fcfc72c8a4
MD5 e4f63d292606d84a129df5a7ce5f8c16
SHA1 a0f0f35796a58569eb00580b41318b42e4a4d1fa
SHA512 574a26d10d48fa7172cb1103cb20b14e5008b2f6390fe8c7ac3d4f509e57d5137d7e9169b6b224bfe81bad33580462d78e3894261d86968acc4ab054c42dd2bd
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zncap0pkJVHeTV7yVkeL57ggUql7:6G3obKTtxH4OcfkY1IVkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-20494.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20494.exe
Size 468KB
SHA256 14eeb072cae0cea4bfacaa7a6a3fb448f67389482862680cb0bc805f82193847
MD5 77765b79dd8e13d94ddbe02bff4caa4a
SHA1 c716979252973b1d7d49576f7e440ccaaf171545
SHA512 eaccc95fdc81d5807f442994f7b4dbec9e3ce13cc7acb527bed8b9c899e5cdd734dda0db3f76949835c2c9d1d15cac7e07dc5b28c06985546520879553d02bbe
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcdp0pkJVHeTV7SKkeL57ggUql7:6G3obKTtxH4Ocf0Y1oKkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22886.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
Size 468KB
SHA256 2abe82701bbefa7f08fba07de84344d02569dbdf85813e75d80af6a1890c47b6
MD5 0d79cb9f7f858e115f33d55805f20409
SHA1 d96c86d07cd39bcb450bf3df60dbdaff4a1bc441
SHA512 e8562dcf1c712323f03d0dd0f8a6cb588c7c381177c73c16e07cdad7238a9e409528bd85d7747920c43072659799bce349a36772764edc41c9fcb9a01c73c1e6
SSDEEP 3072:6G3HogIS5EPTtbY2HzcO9f8/zCcap0fkJVHeTV7yKkeT57ggUql7:6G3oqKTtxH4O9fji1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23440.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23440.exe
Size 468KB
SHA256 7c5fdaaf972c9233bfe28d22e36b967ec71b29f7265b3b6fcbc3c5ade219c8bf
MD5 370aec9c832463e8a6b54a4f05ecce88
SHA1 a235127e4948bb175a1882b0796ba3374ffdba31
SHA512 d9d02aa64692054a4da41f23a75a6c89bad9004ac8ce318be2474e155a79a782b4591e027a53e8af5d5554a600611aff916c710992bb3f41de329c8b41af73fe
SSDEEP 3072:6G3HogISIEPTtbY2HzcO9f8/zCcap0pkJVHeTV7yKkeT57TgUql7:6G3obKTtxH4O9fjY1IKkoNTgU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23566.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23566.exe
Size 468KB
SHA256 bb10b0ea8432ee5aa4a6ae5d72bb04f187c0540c6de4c614303ced40423cf53d
MD5 a1c397877b56aafc8da6384027c63c27
SHA1 42ef2f44c0e181b4f9d0c8ebf8feb21c7a53e9b9
SHA512 ae291254f05c7467fb21ec0091b5ff70a07dc75d3e92420c0a7525aaac41ee3c84b4ac87d05ec8d1bae0bc505cab6020d9458eb73d866c12ced987357b24fecc
SSDEEP 3072:sG3HogISIEPTtbY2HzcOcf8/zCcap0pMJVHeTV7yckeL5nggUql7:sG3obKTtxH4OcfjYNIckgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25359.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
Size 468KB
SHA256 6ba348abab2eedb23040fb0ff82465c7356a2f95a94349721738658c9e7d948a
MD5 cb436b29c62ea4214f1357fca0fa9723
SHA1 78082e5fb5117686ae66115d2816d299439520ae
SHA512 11c3bf07ab2c0b295e50a545f3cc2d197e9f5ed8f5f6f08a01c7703fc36b936ec2deb10069a6cf25a8aace7a34a27ee94ec90196fa5b293e5aefaa4564335115
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zncap0pkJVHeTV7yKkeL57ggUql7:6G3obKTtxH4OcfkY1IKkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25516.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25516.exe
Size 468KB
SHA256 6b3ea8923a37072f0bee42b609357293c754f83fbb4f1e5fb00928c3840eb36b
MD5 58bd4c4f67c95addfc91ab3608beb2ce
SHA1 177e3d9a12e87982d0ee840cf91c1b3899e11c2a
SHA512 0d694e41b95f29309a9c5e91dfa9ea746fd988c17b56d747a10bcbd138a888f5c212677fa36f8e7f8346d263f805c85cb8661c14211e7d3eff0f46764ce4208b
SSDEEP 3072:6G3HogIS5EPTtbY2HzcO9f8/zCcap0pkJVHeTV7yKkeT57ggzql7:6G3oqKTtxH4O9fjY1IKkoNggz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25922.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
Size 468KB
SHA256 e04132199b825624fa95281f7831c5a7b741b841d2be973909d9625c5873a4fd
MD5 b2846347a649b51ae602cc9d8c4ac1cf
SHA1 858ab73c75773449c53a68a7126faceed5b8e3ed
SHA512 c91d62b1c2144021b7ca1840c4b55920941141b924c3227c97c2e12b14200b4abe61b1d4ce953789483e9456774f6f87209cb0cfe87cebbf5d50e007270f0c5f
SSDEEP 3072:6G3HogISIEPTtbYMHzcOcf8/zncap0pkJVHeUV7yKkeL57ggUql7:6G3obKTtXH4OcfkY1VKkgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28050.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
Size 468KB
SHA256 c592545fcf0800a0acf5f9028fa2e93c31138d0feae64e791cdd489fee01a637
MD5 1f7dda1ca39bf94e4640bec0935ee3ab
SHA1 bd72579967d51ea9a2359f221240f498eaf33db8
SHA512 1015bf43ac23c4d8cd990ee00de8831f75640387f9a2fb9a6f328ff5fe83596450f63e9e046ed4229c39a9be684141cf52f4119d3151441f18a4d38e32436b7a
SSDEEP 3072:OG3HogIS5EPftbYdHzcO9f8/zCcap0fkJVHeTV7dKkeTDGggUql7:OG3oqKftyH4O9fji17KkoCggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31490.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
Size 468KB
SHA256 c142b1d6847a15179dc3dd6a08c9ed4fbbb7e5470ddd257a206b389a7bc1de78
MD5 00f1149e82ebcf61dce71b40e5d565f6
SHA1 5e48a59ff305628750fcb4596bb14bfe2cbafd3e
SHA512 8a295494c5dd80130288b3b00d44e16b16bb620e05cef57183e7276875548ee853cc0309e7fae7f23244d38224989e42d20fd91e8507ac589206d67f98e3ec67
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7fKkeL5nggUql7:6G3obKTtxH4OcfjY1tKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31983.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31983.exe
Size 468KB
SHA256 c6842952b8abf9b792d4cf8e4dbb1f3051c0be22054d66b61c15c5feab3c3098
MD5 29c1d6e9f6a1985d40ba67b80dad829c
SHA1 6a8fb4abcd4d047e484c6af7fa7a67a33a4c11d5
SHA512 3e846d79be9a95aabd1f4c4d0fa4bc97fbe9a5318e6e2694d2d128980e3c81fe2e70f4ba407929d8775744073f4917269233dc532cf075475020740b9f97baf9
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKpeL57ggUql7:6G3obKTtxH4OcfjY1IKpgNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32746.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
Size 468KB
SHA256 bc12e9632306bda0c875b2b4f20883933007585629c02f6a994734fc0635fa48
MD5 6ad584df5428a0bb51aa151372b823f1
SHA1 d3a47a50d25952dad4a9c3fe252de622708f2131
SHA512 16ba2b2696c0b2eafb60cd9b3b643f6f0392c00bb430ebfa09dd9a6f6593c9ab527e13971eee63dc4eb05d4b31c750a7f7584e3a13429361c1ea60204edc7581
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7qKkeL5nggUqlG:6G3obKTtxH4OcfjY1AKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33300.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
Size 468KB
SHA256 066174876f02ce5e17664acfef4b5a243fc36f291f898ebc2ac7e24305d249c4
MD5 9d2e1aa07fdd3ca40e1669c7bb04fe5c
SHA1 89130c99fe944ce8788ac476acd2dae67f355d01
SHA512 b1100ac98142112eb7d88f10371035ed72af7d5b61e56c24ba0194bf83a6c8afe7c07155c4ebebb2240f12cfc9a82d01059f3560eef2320d2b681dce625c1ff3
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7fKkeL5nggUqlL:6G3obKTtxH4OcfjY1tKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36830.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
Size 468KB
SHA256 7a53511471325f069dbdaeb7c97e92f277c0a8d0c5e91a57b6fd52a658eeab02
MD5 45d491f082837571fbc8b686273245c3
SHA1 e34ef27c1f60e0ebcd725781f3d3e1e67c670087
SHA512 fba09f9f7946081a0cb936243adfb31a0442d20c653eb06bf875e26c8146a0a2d82577e0ffefd558118be6678e9423b264514f2667b900f08ce4fd280b1a6905
SSDEEP 3072:sG3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yckeL5nggUql7:sG3obKTtxH4OcfjY1IckgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37710.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
Size 468KB
SHA256 e1880bfb4ef4ea257b6c7fd409f6c6254e8920bfb3db8a2cbf38b81a2329eba8
MD5 ac6daa44b42aa46a4f242786d002a2b8
SHA1 db2e10908b63abd39958ab0af584146645404f95
SHA512 cace12fd8a3b21464093e8be3f00dcdab0ee4a0252a78d9a08fc14ed2f7da7043dd220e465611edd2503bf2e7557083ed0be783fa6a173ca06d6bc0582f9c7f4
SSDEEP 3072:+G3Hog0SIEPTtbY2HzcOcf8/zCcdp0pkJVHeTV7fKkpL57ggUPlh:+G3ofKTtxH4Ocf0Y1NKklNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39060.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39060.exe
Size 468KB
SHA256 9ded11c769e691ee8fed60e5524977826139f7a2b8dcf22a7ce293259bb4ee29
MD5 e09f6be5774de0c41213693ccd22ac22
SHA1 1e67e30ae53eacca00bb46df53a1541de6985e08
SHA512 d59839a4046690eb9afad6f5e4194a59ba47f24e7f3576b9dcbbf33bb6735a9b507ed7583b5dffb9dd4e92aaf8eb1a8eb81edb7214603a4f12c783af9f261ced
SSDEEP 3072:6G3HogISIEPTtbY2HzcO9f8/zCcap0pkJVHeTV7YKkeT57ggUql7:6G3obKTtxH4O9fjY1iKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39776.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
Size 468KB
SHA256 604083c1d38be26f06ff2d0236ec4bebfd024c8ce595c61b2ef22d616f7d4a87
MD5 d54200491818303f9e42caf82f657b6e
SHA1 4a468b4e8be735b096369a56a0a67ab4060694af
SHA512 eac6f53ea545e0843ac9f1ca4db7d1a717709bc96b331e1cf04600ea0eb740fbd5d4cd67ec43eb9cd803565c5cbc26222cd1360587031dbb2b6fac529a9c72a8
SSDEEP 3072:sG3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeL5nggUql7:sG3obKTtxH4OcfjY1IKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43638.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
Size 468KB
SHA256 e6de423338d3c3d1cac66e00bbea3670e545b996c1c3b6524f1c856c11523eb7
MD5 dd6818527371b2bc9bdbf3b91d7ad14a
SHA1 ccd508f02deab680987047a2ebc44d4552d32d78
SHA512 fc6c1a6b52ce0b6ad532214e06e4775f88c350b6a763bbe5b775433879a21a98ca7b18a391000fb8b69fa9c4107fdf436a899e0c7618a836339aa50fd234966f
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeT57ggUql7:6G3obKTtxH4OcfjY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-44998.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-44998.exe
Size 468KB
SHA256 1623da31478e5eed690f71b7fde8549e508176223dfbbcdb58381302dcc6ed3d
MD5 f4970f8295668b9af53859d99bbf4945
SHA1 957617383b1e60d9fb149d86fd21e721772d8750
SHA512 4b0b6044efc62c7622a65563b88b82721b18491a84660197a873f65ff9e7c5e792439e8b9006bb2f56199dd9dd6915cff03641043b4a4b2e5256a51087a8f10a
SSDEEP 3072:UG3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeTm7ggUql7:UG3obKTtxH4OcfjY1IKkoUggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47686.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
Size 468KB
SHA256 677882183dd1decad2d768abe99b144c78c048fc4e77366031391f92fc317aca
MD5 55134404c9ae486286b6d5d036d68f4c
SHA1 a3951c3dc40b9d8333e8b7ee446d7a0f96be24c0
SHA512 2f4f18dcfa1705903e3487732f0121aa0980e630a02660f756e233343ff9e5595b011d4c82165dbdca999a52a60879049863fa2d8f348642bc5654802bd27c06
SSDEEP 3072:6G3HogIS5EPetbY2HzcO9f8/zCcap0fkJVHeTV7yKkeTw7ggUql7:6G3oqKetxH4O9fji1IKkoOggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48241.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
Size 468KB
SHA256 bac9d8549d59913a8ec04fe98777ef74f23a9c2afb455a730efb334153aaad6f
MD5 eaf1f4c92ea05193424db3cd877f45a3
SHA1 e47e18cf977790f96b24a995edf4255bb8dd814b
SHA512 e3b6abe6e924be7d5e3a66a1fb0b6f21bdb87c1a7cef0ca3c39e72d2f5cb7836661336dd782aa55ffaefb00e4a2211dac5ab3d46d93a59fcc4f465aa3c4a429a
SSDEEP 3072:6G3HogIS5EPTtbYdHzcO9f8/zCcap0fkJVHeTV7yKkeT57ggUql7:6G3oqKTtyH4O9fji1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51120.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
Size 468KB
SHA256 4dd5e083f4b9f2e4036dc340c44fed928537edf06d3d0367f65b246d11cbec3d
MD5 9962d331c51c2215914af2c9d4289971
SHA1 81b1039c6b4278966a7884522ce4438e6f63f88c
SHA512 93a387feeb3fed6d36b57fdcab072e0f70df3570826d0180961e2caf498eefdb507fbab7fb5a37a672f7d2f6c5597b66c3e2e97b670496cd259b52ac6ff42e53
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7yKkeLrnggUql7:6G3obKTtxH4OcfjY1IKkgTggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52657.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52657.exe
Size 468KB
SHA256 738e38fef5ea99445831d57fc153f181e65ae1c42a170f2c350d082c1fc3c373
MD5 8de6c086c2a9d0aa424531bf5ea7649d
SHA1 d1fdb460c146cb232788dc926fdd287c21be8fe1
SHA512 bd7ae762d710093c2d377bb10fa80412c7c63016e1b586a1fc99a79c09badbfb9842fd190fbf7546083d7ba62d0a53f3babed27723e96aea97f455a240b7cb5a
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/qCcap0pkJVHeTV7yKkeT57ggUql7:6G3obKTtxH4OcfMY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52682.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
Size 468KB
SHA256 2e5a889ff4d449baed9f644edeba0d281765cb8a905306aa674fe0c3684f9c2a
MD5 189ace44656683076f786a072e03cf1d
SHA1 3f637032eceb8f16a692d7d138f119d597703e04
SHA512 276fdc015dcabbd1e37f11233f0a116ae446dd71ef88f829d557db60b8f5b3f4e3f5e9adccf84df15237a24bc6e2ad8011c19929cc44afb2731a32a09901ae6e
SSDEEP 3072:+G3HogISI0PTtbY2H6cdcf8/zCcap0pkJVHeTV7fKkeL5nggUqlG:+G3ob6TtxHjdcfjY1tKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53358.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
Size 468KB
SHA256 cec3524a2fc21837d818e308f78c421f210ec3ca01bc02b53d48b4d6f322093e
MD5 c6b4f4363394c50609106f2be84c559c
SHA1 62ce7eb63e7c2a6b0984e06f3464247ca4421175
SHA512 331b449ffc5f3789f1dee3bcc50980e4ad2eca3e5d520285a460d9b03ef7fed5b98b524aa5081e8352efca96c753dd79c349b13934969cd5d3ef5cb581041351
SSDEEP 3072:6G3HogISIEPTtbY2HzcO9f8/zCcap0pkJVHeTV7yKkeT57PgUql7:6G3obKTtxH4O9fjY1IKkoNPgU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59642.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59642.exe
Size 468KB
SHA256 952cfd777ca43f89fe604c15ade88b945ad6cf202120f599e85ee4152ada8db7
MD5 09081e240f8147192de34410669c25a0
SHA1 10c702d0dacd3e69fc87c5ca285cc3d226f2bcc3
SHA512 7feb5150e91975b829824cf019ac9c65f55932cf070bee2d64383f684b109a5f86b2db232887150c9d0177e9e2fd01d55a5508c3b3eaec5303a4d68240281d00
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/qCcap0pkJVHeTV7yKkeT57ggUUl7:6G3obKTtxH4OcfMY1IKkoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6056.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6056.exe
Size 468KB
SHA256 e250270a9e9f5337d6f91df8330017ce10b10f95603a64bd52af493236a9d035
MD5 eac3a501976634d4dbd9cc3235317c50
SHA1 ffb9df052a343cad35f104232adaa14dfa43f9e7
SHA512 95519147d949a7554150bbc205bd65bc10f61790e590a606141edb65f1aa7940a83828182ff61829231409343133960d5b3fde381262a84310a1c5a1bfc32bd9
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/qCcap0pkJVHeTV7yKceT57ggUql7:6G3obKTtxH4OcfMY1IKcoNggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63726.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63726.exe
Size 468KB
SHA256 0dc4ad9a76c09081deb4f53c6f1b1ce7d6dd7e8e16c866caa35ce811235f35c5
MD5 71896ec4e56828549ca6bc11a6c0cb53
SHA1 e4e8b727a24b2cbe9a7d2acb1157a4699ae54f90
SHA512 6a8b8e0c894c5c1a3d04abea9ebeb53e48cfc73f5dde31a1ae492ea1bce18852008591adcedc4b24f11ee66e3b12304fa109e157b5127b7379fec96bef0a0bdc
SSDEEP 3072:6G3HogISIEPTtbY2HzcOcf8/zCcap0pkJVHeTV7fKkeL5nggUqlG:6G3obKTtxH4OcfjY1tKkgRggU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads