4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2b

Analysis

max time kernel
41s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
Size

468KB
MD5

289cfb676ade7526816f4ac2892cef10
SHA1

945d3ee14bfc6850e7aca4d068a13f6bb069274b
SHA256

4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2b
SHA512

8240e5191645e15611321c5b0f497f30feb4f7cfcb47a5c01dce1864b0d76ae2337a9df7d66f91669b1088b9086fcbc4fc9b5e0c6e03a1ea7c33f524675109d1
SSDEEP

3072:1G3HogISIE5TtbY2HzcOcf8/zCc8P0pkJVHeTVPyQ6RLa7tgErlL:1G3obMTtxH4OcfHY10Q6NYtgE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3368	Unicorn-1547.exe
3192	Unicorn-40224.exe
2532	Unicorn-28526.exe
3488	Unicorn-42684.exe
1600	Unicorn-39154.exe
3044	Unicorn-52890.exe
3384	Unicorn-42056.exe
1564	Unicorn-26274.exe
1528	Unicorn-58392.exe
1644	Unicorn-1023.exe
3968	Unicorn-4842.exe
964	Unicorn-64514.exe
4756	Unicorn-32648.exe
3472	Unicorn-25034.exe
212	Unicorn-4251.exe
4460	Unicorn-10373.exe
3680	Unicorn-45092.exe
2044	Unicorn-44827.exe
2132	Unicorn-25226.exe
428	Unicorn-36161.exe
4580	Unicorn-10063.exe
2024	Unicorn-18786.exe
2276	Unicorn-63348.exe
712	Unicorn-43888.exe
2940	Unicorn-23660.exe
2420	Unicorn-17529.exe
2288	Unicorn-40550.exe
1828	Unicorn-60151.exe
2632	Unicorn-60416.exe
1544	Unicorn-4701.exe
4376	Unicorn-14153.exe
1428	Unicorn-63155.exe
4904	Unicorn-16320.exe
3532	Unicorn-17258.exe
1316	Unicorn-49376.exe
2816	Unicorn-55498.exe
1048	Unicorn-58504.exe
3796	Unicorn-42722.exe
3560	Unicorn-38276.exe
4800	Unicorn-30662.exe
4224	Unicorn-21172.exe
3000	Unicorn-21364.exe
3372	Unicorn-9998.exe
3968	Unicorn-10263.exe
1388	Unicorn-55935.exe
3236	Unicorn-18432.exe
4712	Unicorn-18432.exe
2768	Unicorn-26600.exe
2104	Unicorn-46636.exe
664	Unicorn-5371.exe
3436	Unicorn-53843.exe
4708	Unicorn-8925.exe
4576	Unicorn-17590.exe
3832	Unicorn-11725.exe
1704	Unicorn-63527.exe
3512	Unicorn-59848.exe
3900	Unicorn-64487.exe
756	Unicorn-36496.exe
1116	Unicorn-56916.exe
1684	Unicorn-65084.exe
1676	Unicorn-25705.exe
4324	Unicorn-20138.exe
4944	Unicorn-51991.exe
5036	Unicorn-60424.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1520	3192	WerFault.exe	85
3304	3192	WerFault.exe	85
232	1528	WerFault.exe	102
1760	3968	WerFault.exe	103
1316	1644	WerFault.exe	104
432	3044	WerFault.exe	92
4016	3044	WerFault.exe	92
404	1528	WerFault.exe	102
3312	1644	WerFault.exe	104
1388	3968	WerFault.exe	103
1548	2044	WerFault.exe	112
4220	964	WerFault.exe	105
4540	2132	WerFault.exe	113
2732	4460	WerFault.exe	110
5088	4460	WerFault.exe	110
5000	2044	WerFault.exe	112
3520	964	WerFault.exe	105
3124	2132	WerFault.exe	113
464	1428	WerFault.exe	144
3020	1428	WerFault.exe	144
5452	1704	WerFault.exe	181
5624	3436	WerFault.exe	177
1656	1684	WerFault.exe	188
5588	1828	WerFault.exe	138
5532	3000	WerFault.exe	167
5560	1704	WerFault.exe	181
4880	3436	WerFault.exe	177
1424	1684	WerFault.exe	188
6860	3000	WerFault.exe	167
2660	3412	WerFault.exe	226
6452	5752	WerFault.exe	249
4332	2420	WerFault.exe	134
7908	5780	WerFault.exe	251
6192	5608	WerFault.exe	320
3852	5152	WerFault.exe	308
9496	5812	WerFault.exe	361
11164	3512	WerFault.exe	183
636	6236	WerFault.exe	328
11728	7352	WerFault.exe	440
11624	7604	WerFault.exe	401
11476	2576	WerFault.exe	384
11468	1292	WerFault.exe	464
11444	2316	WerFault.exe	465
11436	7912	WerFault.exe	413
12080	6380	WerFault.exe	335
11240	5244	WerFault.exe	232
1016	4984	WerFault.exe	206
10372	5840	WerFault.exe	313
2732	6276	WerFault.exe	330
11428	7984	WerFault.exe	467
11416	7324	WerFault.exe	393
11408	7540	WerFault.exe	398
11400	8148	WerFault.exe	423
11392	7856	WerFault.exe	411
11384	8036	WerFault.exe	417
11376	6408	WerFault.exe	389
11368	7060	WerFault.exe	426
11360	8060	WerFault.exe	451
11352	7768	WerFault.exe	407
11344	6804	WerFault.exe	434
11336	7016	WerFault.exe	431
11328	8188	WerFault.exe	425
760	7636	WerFault.exe	463
12660	6420	WerFault.exe	336

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27856.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53023.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
3368	Unicorn-1547.exe
3192	Unicorn-40224.exe
2532	Unicorn-28526.exe
3488	Unicorn-42684.exe
3044	Unicorn-52890.exe
1600	Unicorn-39154.exe
3384	Unicorn-42056.exe
1564	Unicorn-26274.exe
1528	Unicorn-58392.exe
1644	Unicorn-1023.exe
3968	Unicorn-4842.exe
964	Unicorn-64514.exe
4756	Unicorn-32648.exe
3472	Unicorn-25034.exe
212	Unicorn-4251.exe
4460	Unicorn-10373.exe
2132	Unicorn-25226.exe
428	Unicorn-36161.exe
3680	Unicorn-45092.exe
2044	Unicorn-44827.exe
4580	Unicorn-10063.exe
2024	Unicorn-18786.exe
2276	Unicorn-63348.exe
712	Unicorn-43888.exe
2420	Unicorn-17529.exe
2940	Unicorn-23660.exe
1828	Unicorn-60151.exe
4376	Unicorn-14153.exe
1544	Unicorn-4701.exe
2288	Unicorn-40550.exe
1428	Unicorn-63155.exe
2632	Unicorn-60416.exe
4904	Unicorn-16320.exe
3532	Unicorn-17258.exe
1316	Unicorn-49376.exe
2816	Unicorn-55498.exe
1048	Unicorn-58504.exe
3796	Unicorn-42722.exe
4800	Unicorn-30662.exe
3560	Unicorn-38276.exe
4224	Unicorn-21172.exe
3000	Unicorn-21364.exe
3968	Unicorn-10263.exe
3372	Unicorn-9998.exe
4712	Unicorn-18432.exe
3236	Unicorn-18432.exe
2768	Unicorn-26600.exe
1388	Unicorn-55935.exe
2104	Unicorn-46636.exe
664	Unicorn-5371.exe
3436	Unicorn-53843.exe
4708	Unicorn-8925.exe
1704	Unicorn-63527.exe
4576	Unicorn-17590.exe
3832	Unicorn-11725.exe
3512	Unicorn-59848.exe
3900	Unicorn-64487.exe
756	Unicorn-36496.exe
1116	Unicorn-56916.exe
1684	Unicorn-65084.exe
1676	Unicorn-25705.exe
4324	Unicorn-20138.exe
4944	Unicorn-51991.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3368	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	82
PID 2924 wrote to memory of 3368	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	82
PID 2924 wrote to memory of 3368	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	82
PID 3368 wrote to memory of 3192	3368	Unicorn-1547.exe	85
PID 3368 wrote to memory of 3192	3368	Unicorn-1547.exe	85
PID 3368 wrote to memory of 3192	3368	Unicorn-1547.exe	85
PID 2924 wrote to memory of 2532	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	86
PID 2924 wrote to memory of 2532	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	86
PID 2924 wrote to memory of 2532	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	86
PID 2532 wrote to memory of 3488	2532	Unicorn-28526.exe	89
PID 2532 wrote to memory of 3488	2532	Unicorn-28526.exe	89
PID 2532 wrote to memory of 3488	2532	Unicorn-28526.exe	89
PID 3368 wrote to memory of 1600	3368	Unicorn-1547.exe	91
PID 3368 wrote to memory of 1600	3368	Unicorn-1547.exe	91
PID 3368 wrote to memory of 1600	3368	Unicorn-1547.exe	91
PID 2924 wrote to memory of 3044	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	92
PID 2924 wrote to memory of 3044	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	92
PID 2924 wrote to memory of 3044	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	92
PID 3488 wrote to memory of 3384	3488	Unicorn-42684.exe	100
PID 3488 wrote to memory of 3384	3488	Unicorn-42684.exe	100
PID 3488 wrote to memory of 3384	3488	Unicorn-42684.exe	100
PID 2532 wrote to memory of 1564	2532	Unicorn-28526.exe	101
PID 2532 wrote to memory of 1564	2532	Unicorn-28526.exe	101
PID 2532 wrote to memory of 1564	2532	Unicorn-28526.exe	101
PID 3044 wrote to memory of 1528	3044	Unicorn-52890.exe	102
PID 3044 wrote to memory of 1528	3044	Unicorn-52890.exe	102
PID 3044 wrote to memory of 1528	3044	Unicorn-52890.exe	102
PID 1600 wrote to memory of 1644	1600	Unicorn-39154.exe	104
PID 1600 wrote to memory of 1644	1600	Unicorn-39154.exe	104
PID 1600 wrote to memory of 1644	1600	Unicorn-39154.exe	104
PID 2924 wrote to memory of 3968	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	103
PID 2924 wrote to memory of 3968	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	103
PID 2924 wrote to memory of 3968	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	103
PID 3368 wrote to memory of 964	3368	Unicorn-1547.exe	105
PID 3368 wrote to memory of 964	3368	Unicorn-1547.exe	105
PID 3368 wrote to memory of 964	3368	Unicorn-1547.exe	105
PID 3384 wrote to memory of 4756	3384	Unicorn-42056.exe	106
PID 3384 wrote to memory of 4756	3384	Unicorn-42056.exe	106
PID 3384 wrote to memory of 4756	3384	Unicorn-42056.exe	106
PID 3488 wrote to memory of 3472	3488	Unicorn-42684.exe	107
PID 3488 wrote to memory of 3472	3488	Unicorn-42684.exe	107
PID 3488 wrote to memory of 3472	3488	Unicorn-42684.exe	107
PID 1564 wrote to memory of 212	1564	Unicorn-26274.exe	108
PID 1564 wrote to memory of 212	1564	Unicorn-26274.exe	108
PID 1564 wrote to memory of 212	1564	Unicorn-26274.exe	108
PID 2532 wrote to memory of 4460	2532	Unicorn-28526.exe	110
PID 2532 wrote to memory of 4460	2532	Unicorn-28526.exe	110
PID 2532 wrote to memory of 4460	2532	Unicorn-28526.exe	110
PID 964 wrote to memory of 3680	964	Unicorn-64514.exe	111
PID 964 wrote to memory of 3680	964	Unicorn-64514.exe	111
PID 964 wrote to memory of 3680	964	Unicorn-64514.exe	111
PID 3368 wrote to memory of 2044	3368	Unicorn-1547.exe	112
PID 3368 wrote to memory of 2044	3368	Unicorn-1547.exe	112
PID 3368 wrote to memory of 2044	3368	Unicorn-1547.exe	112
PID 1600 wrote to memory of 2132	1600	Unicorn-39154.exe	113
PID 1600 wrote to memory of 2132	1600	Unicorn-39154.exe	113
PID 1600 wrote to memory of 2132	1600	Unicorn-39154.exe	113
PID 2924 wrote to memory of 428	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	114
PID 2924 wrote to memory of 428	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	114
PID 2924 wrote to memory of 428	2924	4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe	114
PID 4756 wrote to memory of 4580	4756	Unicorn-32648.exe	130
PID 4756 wrote to memory of 4580	4756	Unicorn-32648.exe	130
PID 4756 wrote to memory of 4580	4756	Unicorn-32648.exe	130
PID 3384 wrote to memory of 2024	3384	Unicorn-42056.exe	131

C:\Users\Admin\AppData\Local\Temp\4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe
"C:\Users\Admin\AppData\Local\Temp\4b3fbdcb3f4343a92000c3d8a45d90f1c61fe329625c66a6fc93967f5ace2e2bN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1547.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1547.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 728
      4⤵
      Program crash
      PID:1520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 728
      4⤵
      Program crash
      PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 644
        5⤵
        Program crash
        
        PID:1316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 644
        5⤵
        Program crash
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 728
        5⤵
        Program crash
        
        PID:4540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 728
        5⤵
        Program crash
        
        PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9251.exe
        6⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57332.exe
        9⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41627.exe
        9⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        7⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8080 -s 640
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64222.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        7⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43262.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        6⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 632
        7⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13145.exe
        6⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        5⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22252.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59984.exe
        7⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        6⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53699.exe
        5⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52200.exe
        6⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43498.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
        5⤵
        
        PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17590.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
      4⤵
      PID:3412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 628
        5⤵
        Program crash
        
        PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31850.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11587.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64623.exe
        6⤵
        
        PID:2420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 652
        5⤵
        Program crash
        
        PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
      4⤵
      PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20576.exe
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43871.exe
        5⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27842.exe
      4⤵
      PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8291.exe
        7⤵
        
        PID:708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 724
        7⤵
        Program crash
        
        PID:5532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 724
        7⤵
        Program crash
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21830.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        8⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 636
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2682.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        7⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43682.exe
        6⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58811.exe
        9⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57975.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6123.exe
        9⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        8⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        7⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7984 -s 636
        8⤵
        Program crash
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        7⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10730.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        6⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51467.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63452.exe
        6⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17784.exe
        9⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63108.exe
        10⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53175.exe
        9⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8737.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        8⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21207.exe
        9⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48378.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64363.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        9⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55006.exe
        8⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17507.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39823.exe
        7⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46740.exe
        7⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 636
        8⤵
        Program crash
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        7⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5336 -s 664
        7⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55531.exe
        6⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25675.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        6⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31325.exe
        5⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60860.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58328.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33958.exe
        7⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        5⤵
        
        PID:5812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 632
        6⤵
        Program crash
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
        6⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18794.exe
        5⤵
        
        PID:10008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 728
      4⤵
      Program crash
      PID:4220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 728
      4⤵
      Program crash
      PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 640
      4⤵
      Program crash
      PID:1548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 640
      4⤵
      Program crash
      PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20352.exe
        5⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        7⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42864.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        9⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        10⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30606.exe
        9⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32178.exe
        8⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15945.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        7⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8684 -s 636
        8⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        7⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53735.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        7⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 548
        7⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50714.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50923.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        6⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33018.exe
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19874.exe
        6⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        7⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23869.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12561.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
        6⤵
        
        PID:9824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 656
        6⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        5⤵
        
        PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
      4⤵
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39864.exe
        5⤵
        
        PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        5⤵
        
        PID:1292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 636
        6⤵
        Program crash
        
        PID:11468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 628
        5⤵
        Program crash
        
        PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
      4⤵
      PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53108.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37642.exe
      4⤵
      PID:13608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53843.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 636
      4⤵
      Program crash
      PID:5624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 656
      4⤵
      Program crash
      PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42460.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56392.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52412.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49636.exe
        6⤵
        
        PID:10140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 632
        6⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40102.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44290.exe
        5⤵
        
        PID:11308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      4⤵
      PID:6340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6340 -s 636
        5⤵
        
        PID:11876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
    3⤵
    PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
      4⤵
      PID:8060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 544
        5⤵
        Program crash
        
        PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3258.exe
      4⤵
      PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        5⤵
        
        PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3397.exe
      4⤵
      PID:4380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
    3⤵
    PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
      4⤵
      PID:11596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
    3⤵
    PID:9920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59848.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43948.exe
        10⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49480.exe
        11⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        12⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54364.exe
        13⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        12⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14165.exe
        12⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        11⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52008.exe
        12⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65478.exe
        11⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3261.exe
        11⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        9⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 744
        9⤵
        Program crash
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14850.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50824.exe
        10⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 636
        11⤵
        Program crash
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16942.exe
        10⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9384 -s 636
        11⤵
        
        PID:14524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 716
        10⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20974.exe
        9⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        10⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        10⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 716
        9⤵
        Program crash
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        9⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        10⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32998.exe
        9⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        9⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23803.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
        9⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        9⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64487.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34716.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52500.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 628
        10⤵
        Program crash
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22650.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
        9⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 636
        10⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 628
        9⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58586.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33565.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44922.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        8⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36496.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25705.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27088.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19770.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        9⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8074.exe
        9⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        9⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
        10⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8004 -s 632
        9⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        8⤵
        
        PID:932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8108 -s 636
        8⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33329.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39948.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
        7⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25609.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
        7⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31776.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62726.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49376.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 724
        8⤵
        Program crash
        
        PID:1656
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 768
        8⤵
        Program crash
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
        7⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 632
        8⤵
        Program crash
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12422.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24329.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20138.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18100.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40160.exe
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        9⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        10⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 632
        9⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53787.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        9⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7851.exe
        10⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
        9⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33889.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44836.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45775.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-786.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        7⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        8⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47119.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11310.exe
        8⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60626.exe
        7⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
        7⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33839.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        6⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38220.exe
        7⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        6⤵
        
        PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29112.exe
        8⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 636
        9⤵
        Program crash
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64835.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3101.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        8⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18189.exe
        7⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27258.exe
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43668.exe
        7⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46543.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47156.exe
        8⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 636
        7⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 636
        7⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
        6⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 628
        7⤵
        Program crash
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19438.exe
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        7⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42834.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48257.exe
        6⤵
        
        PID:13404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51991.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19444.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        6⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8720 -s 724
        7⤵
        
        PID:14020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 616
        6⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        5⤵
        
        PID:5752
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 724
        6⤵
        Program crash
        
        PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7139.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31992.exe
        9⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31084.exe
        10⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8276 -s 636
        11⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 660
        10⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        9⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27924.exe
        10⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7254.exe
        10⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
        9⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        9⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        8⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15235.exe
        9⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22386.exe
        9⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61395.exe
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        10⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13017.exe
        10⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6434.exe
        9⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        9⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        8⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 628
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        8⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        9⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8172 -s 752
        8⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24099.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        7⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20330.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 628
        8⤵
        Program crash
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38374.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17940.exe
        8⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 668
        7⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42722.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60424.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8795.exe
        9⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 632
        9⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55671.exe
        8⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 636
        9⤵
        
        PID:14692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 660
        8⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25914.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        9⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50975.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39038.exe
        7⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 636
        8⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40015.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40865.exe
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        6⤵
        
        PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58570.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44192.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        5⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        9⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        8⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9261.exe
        7⤵
        
        PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43402.exe
        7⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 636
        8⤵
        Program crash
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        7⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 636
        8⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        6⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5095.exe
        7⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8100 -s 628
        7⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25374.exe
        5⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23388.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62464.exe
        8⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 660
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6854.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5687.exe
        8⤵
        
        PID:12256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58742.exe
        7⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6454.exe
        6⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7768 -s 644
        7⤵
        Program crash
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25220.exe
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
        6⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30192.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21185.exe
        7⤵
        
        PID:15316
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 668
        6⤵
        
        PID:12820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 720
        5⤵
        Program crash
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9998.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60300.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19040.exe
        8⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5739.exe
        9⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        8⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 724
        7⤵
        Program crash
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        6⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 636
        7⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47903.exe
        6⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-487.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        7⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7124 -s 628
        7⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3014.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44524.exe
        5⤵
        
        PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49563.exe
        5⤵
        
        PID:7636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7636 -s 636
        6⤵
        Program crash
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2210.exe
        5⤵
        
        PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45564.exe
      4⤵
      PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        5⤵
        
        PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      4⤵
      PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38276.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52448.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27856.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23632.exe
        9⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18744.exe
        10⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        11⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 632
        10⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
        9⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 644
        9⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20153.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26544.exe
        9⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35656.exe
        9⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        10⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55827.exe
        9⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        9⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13122.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        6⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13875.exe
        8⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 636
        9⤵
        Program crash
        
        PID:11368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6236 -s 628
        8⤵
        Program crash
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45479.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        8⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46647.exe
        8⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 720
        7⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34275.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        7⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14635.exe
        6⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        6⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14259.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25708.exe
        8⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8024 -s 648
        8⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36770.exe
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58380.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45519.exe
        8⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8088 -s 632
        7⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        6⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2377.exe
        6⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        5⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43927.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5759.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63284.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36838.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        7⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64670.exe
        5⤵
        
        PID:7540
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7540 -s 636
        6⤵
        Program crash
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31378.exe
        5⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        6⤵
        
        PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42832.exe
        5⤵
        
        PID:14876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18432.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49044.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30714.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18530.exe
        7⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63558.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26855.exe
        7⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        6⤵
        
        PID:8124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 636
        6⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36632.exe
        9⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 660
        8⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        7⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60242.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        6⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 608
        7⤵
        Program crash
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        6⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36007.exe
        7⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
        6⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40840.exe
        6⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        7⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4513.exe
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34711.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        6⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61422.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
        5⤵
        
        PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        6⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45135.exe
        8⤵
        
        PID:13412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38147.exe
        6⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35094.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        6⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61172.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        7⤵
        
        PID:13640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 660
        6⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44134.exe
        5⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        5⤵
        
        PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50595.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50114.exe
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52898.exe
        6⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28581.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49302.exe
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
      4⤵
      PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 640
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 640
      4⤵
      Program crash
      PID:5088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-907.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        9⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18568.exe
        9⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        8⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5528 -s 732
        7⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        6⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6408 -s 636
        7⤵
        Program crash
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17290.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
        6⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13330.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63298.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2054.exe
        5⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14291.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54074.exe
        5⤵
        
        PID:12312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 636
      4⤵
      Program crash
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50907.exe
        5⤵
        
        PID:6888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 636
        6⤵
        
        PID:14164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 636
        5⤵
        
        PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14674.exe
      4⤵
      PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
      4⤵
      PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43995.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14105.exe
      4⤵
      PID:13540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53023.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
      4⤵
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36076.exe
        5⤵
        
        PID:2576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 648
        6⤵
        Program crash
        
        PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
      4⤵
      PID:7016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 636
        5⤵
        Program crash
        
        PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52459.exe
      4⤵
      PID:12176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
    3⤵
    PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        5⤵
        
        PID:9276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 636
        5⤵
        
        PID:11176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6696 -s 640
      4⤵
      PID:9060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58329.exe
    3⤵
    PID:1128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 636
      4⤵
      PID:12860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
    3⤵
    PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25654.exe
    3⤵
    PID:12208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 720
      4⤵
      Program crash
      PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 720
      4⤵
      Program crash
      PID:404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 632
    3⤵
    - Program crash
    PID:432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 664
    3⤵
    - Program crash
    PID:4016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 644
    3⤵
    - Program crash
    PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 644
    3⤵
    - Program crash
    PID:1388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        7⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 636
        8⤵
        Program crash
        
        PID:11416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 664
        7⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54296.exe
        7⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 636
        7⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42110.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16492.exe
        7⤵
        
        PID:10056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 636
        6⤵
        Program crash
        
        PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
        5⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        5⤵
        
        PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50455.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        5⤵
        
        PID:7844
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 636
        6⤵
        
        PID:11564
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7844 -s 636
        6⤵
        
        PID:8628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 652
        5⤵
        Program crash
        
        PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-886.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
        5⤵
        
        PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
      4⤵
      PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22702.exe
      4⤵
      PID:8660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 644
      4⤵
      Program crash
      PID:5452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 632
      4⤵
      Program crash
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
      4⤵
      PID:8188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8188 -s 636
        5⤵
        Program crash
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
      4⤵
      PID:9508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 768
      4⤵
      PID:11008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36185.exe
    3⤵
    PID:2316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 636
      4⤵
      Program crash
      PID:11444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
    3⤵
    PID:9520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
    3⤵
    PID:12284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 724
    3⤵
    - Program crash
    PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 724
    3⤵
    - Program crash
    PID:3020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5371.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    3⤵
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63076.exe
        5⤵
        
        PID:8148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8148 -s 648
        6⤵
        Program crash
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        5⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        6⤵
        
        PID:13948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 716
        5⤵
        
        PID:13852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37310.exe
      4⤵
      PID:7836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7836 -s 636
        5⤵
        
        PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34343.exe
      4⤵
      PID:12628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
  2⤵
  PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        5⤵
        
        PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18005.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
      4⤵
      PID:13416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41394.exe
    3⤵
    PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      4⤵
      PID:9912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 640
      4⤵
      PID:5532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
    3⤵
    PID:12992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45350.exe
  2⤵
  PID:5744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
  2⤵
  PID:8920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
    3⤵
    PID:13880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
  2⤵
  PID:10164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15654.exe
  2⤵
  PID:13328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3192 -ip 3192
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3192 -ip 3192
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1528 -ip 1528
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3968 -ip 3968
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3044 -ip 3044
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1644 -ip 1644
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1528 -ip 1528
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3044 -ip 3044
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1644 -ip 1644
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3968 -ip 3968
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4460 -ip 4460
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 964 -ip 964
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2044 -ip 2044
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2132 -ip 2132
1⤵
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2044 -ip 2044
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4460 -ip 4460
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2132 -ip 2132
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 964 -ip 964
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 1428 -ip 1428
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1428 -ip 1428
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1828 -ip 1828
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1704 -ip 1704
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3436 -ip 3436
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 756 -ip 756
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1684 -ip 1684
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3532 -ip 3532
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1040 -ip 1040
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3604 -ip 3604
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 708 -ip 708
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3532 -ip 3532
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 756 -ip 756
1⤵
PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1040 -ip 1040
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3604 -ip 3604
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 708 -ip 708
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3000 -ip 3000
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1704 -ip 1704
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3436 -ip 3436
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1828 -ip 1828
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1684 -ip 1684
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5200 -ip 5200
1⤵
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2732 -ip 2732
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3412 -ip 3412
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 2732 -ip 2732
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3412 -ip 3412
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5200 -ip 5200
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 3000 -ip 3000
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2332 -ip 2332
1⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3908 -ip 3908
1⤵
PID:6312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5136 -ip 5136
1⤵
PID:6472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5752 -ip 5752
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 3908 -ip 3908
1⤵
PID:7036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2332 -ip 2332
1⤵
PID:7156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5136 -ip 5136
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4580 -ip 4580
1⤵
PID:6728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2420 -ip 2420
1⤵
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3384 -ip 3384
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 4576 -ip 4576
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3472 -ip 3472
1⤵
PID:7220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 5780 -ip 5780
1⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5864 -ip 5864
1⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5916 -ip 5916
1⤵
PID:7696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5236 -ip 5236
1⤵
PID:7704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5976 -ip 5976
1⤵
PID:7712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5704 -ip 5704
1⤵
PID:7748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 5696 -ip 5696
1⤵
PID:7756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5720 -ip 5720
1⤵
PID:7788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5452 -ip 5452
1⤵
PID:7840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5772 -ip 5772
1⤵
PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4580 -ip 4580
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4576 -ip 4576
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2276 -ip 2276
1⤵
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 3384 -ip 3384
1⤵
PID:7624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1092 -ip 1092
1⤵
PID:7964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3472 -ip 3472
1⤵
PID:8136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5608 -ip 5608
1⤵
PID:7156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5780 -ip 5780
1⤵
PID:7124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3796 -ip 3796
1⤵
PID:7004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4492 -ip 4492
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 2744 -ip 2744
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5152 -ip 5152
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5592 -ip 5592
1⤵
PID:8020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1472 -ip 1472
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 460 -ip 460
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3560 -ip 3560
1⤵
PID:6224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5916 -ip 5916
1⤵
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 5224 -ip 5224
1⤵
PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5464 -ip 5464
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5864 -ip 5864
1⤵
PID:7276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5452 -ip 5452
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 5720 -ip 5720
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5236 -ip 5236
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 5976 -ip 5976
1⤵
PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 5704 -ip 5704
1⤵
PID:8240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5772 -ip 5772
1⤵
PID:8384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5696 -ip 5696
1⤵
PID:8508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2276 -ip 2276
1⤵
PID:8568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1092 -ip 1092
1⤵
PID:8620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 5288 -ip 5288
1⤵
PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6172 -ip 6172
1⤵
PID:8864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 5352 -ip 5352
1⤵
PID:8988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4168 -ip 4168
1⤵
PID:9048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5252 -ip 5252
1⤵
PID:9100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4492 -ip 4492
1⤵
PID:9132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2744 -ip 2744
1⤵
PID:9188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5152 -ip 5152
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3796 -ip 3796
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5592 -ip 5592
1⤵
PID:7732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1472 -ip 1472
1⤵
PID:7192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6160 -ip 6160
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6428 -ip 6428
1⤵
PID:8272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6712 -ip 6712
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 460 -ip 460
1⤵
PID:7868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 3560 -ip 3560
1⤵
PID:8292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 6264 -ip 6264
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6744 -ip 6744
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6720 -ip 6720
1⤵
PID:7744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6196 -ip 6196
1⤵
PID:8792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5996 -ip 5996
1⤵
PID:8620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5464 -ip 5464
1⤵
PID:8520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5224 -ip 5224
1⤵
PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3512 -ip 3512
1⤵
PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 664 -ip 664
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1852 -ip 1852
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5276 -ip 5276
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5948 -ip 5948
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5352 -ip 5352
1⤵
PID:8812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5812 -ip 5812
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5744 -ip 5744
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1004 -ip 1004
1⤵
PID:7292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2732 -ip 2732
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 6168 -ip 6168
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4380 -ip 4380
1⤵
PID:9300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 3604 -ip 3604
1⤵
PID:9340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6172 -ip 6172
1⤵
PID:9408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4168 -ip 4168
1⤵
PID:9460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5288 -ip 5288
1⤵
PID:9468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5252 -ip 5252
1⤵
PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5752 -ip 5752
1⤵
PID:9596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 3372 -ip 3372
1⤵
PID:9624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 6160 -ip 6160
1⤵
PID:9672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 1676 -ip 1676
1⤵
PID:9692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 6428 -ip 6428
1⤵
PID:10056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6712 -ip 6712
1⤵
PID:9224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 5852 -ip 5852
1⤵
PID:9340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 6744 -ip 6744
1⤵
PID:9644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6264 -ip 6264
1⤵
PID:10096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 6196 -ip 6196
1⤵
PID:9612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 5828 -ip 5828
1⤵
PID:9768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1216 -p 6720 -ip 6720
1⤵
PID:9812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5996 -ip 5996
1⤵
PID:10116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5456 -ip 5456
1⤵
PID:10164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1852 -ip 1852
1⤵
PID:10208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 1040 -ip 1040
1⤵
PID:9848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 6080 -ip 6080
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 5860 -ip 5860
1⤵
PID:7148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6188 -ip 6188
1⤵
PID:9180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1704 -ip 1704
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8124 -ip 8124
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1088 -p 5276 -ip 5276
1⤵
PID:10228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 8140 -ip 8140
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 6568 -ip 6568
1⤵
PID:9612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 7164 -ip 7164
1⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6448 -ip 6448
1⤵
PID:9924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1180 -p 5432 -ip 5432
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5424 -ip 5424
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1640 -ip 1640
1⤵
PID:10360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5532 -ip 5532
1⤵
PID:10868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 3512 -ip 3512
1⤵
PID:10892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 4224 -ip 4224
1⤵
PID:10904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5948 -ip 5948
1⤵
PID:10920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5936 -ip 5936
1⤵
PID:10972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3236 -ip 3236
1⤵
PID:11028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 664 -ip 664
1⤵
PID:11060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 2420 -ip 2420
1⤵
PID:11124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1860 -ip 1860
1⤵
PID:11188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1004 -ip 1004
1⤵
PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5128 -ip 5128
1⤵
PID:10088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 1760 -ip 1760
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5572 -ip 5572
1⤵
PID:9076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6236 -ip 6236
1⤵
PID:10784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2732 -ip 2732
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 5744 -ip 5744
1⤵
PID:10968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3604 -ip 3604
1⤵
PID:11068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4380 -ip 4380
1⤵
PID:11056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7636 -ip 7636
1⤵
PID:10600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 8188 -ip 8188
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 7016 -ip 7016
1⤵
PID:10608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 6804 -ip 6804
1⤵
PID:11588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 7768 -ip 7768
1⤵
PID:11764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 8060 -ip 8060
1⤵
PID:11948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 7060 -ip 7060
1⤵
PID:11992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6408 -ip 6408
1⤵
PID:12028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 8036 -ip 8036
1⤵
PID:12068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 8148 -ip 8148
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 7856 -ip 7856
1⤵
PID:12172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 7540 -ip 7540
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 7324 -ip 7324
1⤵
PID:6708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 7912 -ip 7912
1⤵
PID:11608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 7984 -ip 7984
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 2316 -ip 2316
1⤵
PID:11540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 1292 -ip 1292
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2576 -ip 2576
1⤵
PID:11992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 7352 -ip 7352
1⤵
PID:12380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 7604 -ip 7604
1⤵
PID:12684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 6168 -ip 6168
1⤵
PID:12900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3372 -ip 3372
1⤵
PID:13084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6380 -ip 6380
1⤵
PID:13204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1676 -ip 1676
1⤵
PID:13212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5852 -ip 5852
1⤵
PID:13264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5840 -ip 5840
1⤵
PID:13288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1244 -p 6276 -ip 6276
1⤵
PID:12208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5244 -ip 5244
1⤵
PID:11280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4984 -ip 4984
1⤵
PID:11064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2264 -ip 2264
1⤵
PID:12292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6696 -ip 6696
1⤵
PID:11860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 7836 -ip 7836
1⤵
PID:12392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 7844 -ip 7844
1⤵
PID:12072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6340 -ip 6340
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5828 -ip 5828
1⤵
PID:13096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1040 -ip 1040
1⤵
PID:12904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5456 -ip 5456
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6080 -ip 6080
1⤵
PID:11508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 5860 -ip 5860
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 6188 -ip 6188
1⤵
PID:13276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1704 -ip 1704
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 8124 -ip 8124
1⤵
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 8140 -ip 8140
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 7096 -ip 7096
1⤵
PID:12692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 4288 -ip 4288
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5620 -ip 5620
1⤵
PID:12908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 5704 -ip 5704
1⤵
PID:12036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 7696 -ip 7696
1⤵
PID:13044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 6420 -ip 6420
1⤵
PID:11176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 8080 -ip 8080
1⤵
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1128 -ip 1128
1⤵
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6528 -ip 6528
1⤵
PID:13324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6232 -ip 6232
1⤵
PID:13412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 6568 -ip 6568
1⤵
PID:13616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 7164 -ip 7164
1⤵
PID:13680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 1640 -ip 1640
1⤵
PID:13688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 5432 -ip 5432
1⤵
PID:13696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6448 -ip 6448
1⤵
PID:13704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 5608 -ip 5608
1⤵
PID:13760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4224 -ip 4224
1⤵
PID:13808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 5532 -ip 5532
1⤵
PID:13892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5528 -ip 5528
1⤵
PID:13900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3236 -ip 3236
1⤵
PID:14012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4944 -ip 4944
1⤵
PID:14096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5936 -ip 5936
1⤵
PID:14316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1860 -ip 1860
1⤵
PID:10416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 5128 -ip 5128
1⤵
PID:13860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 1760 -ip 1760
1⤵
PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1272 -p 5572 -ip 5572
1⤵
PID:11992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1120 -p 8276 -ip 8276
1⤵
PID:14440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 5516 -ip 5516
1⤵
PID:14548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5672 -ip 5672
1⤵
PID:14564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 5300 -ip 5300
1⤵
PID:14604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 5648 -ip 5648
1⤵
PID:14848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 7024 -ip 7024
1⤵
PID:14952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 8720 -ip 8720
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 6888 -ip 6888
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 8684 -ip 8684
1⤵
PID:13400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4576 -ip 4576
1⤵
PID:14036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2432 -ip 2432
1⤵
PID:13860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1408 -ip 1408
1⤵
PID:14736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6368 -ip 6368
1⤵
PID:15004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 3188 -ip 3188
1⤵
PID:9524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 8172 -ip 8172
1⤵
PID:15048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10063.exe

Filesize
468KB

MD5
5e87e299b7b530e37b645ec9efe66e3a

SHA1
74b3f304445d2c95a647348a9adf38a7f26b1b03

SHA256
3d902099ef078511d8198a22e46e83d35516f12bb17bdb0d4fd529e50ed12e15

SHA512
59b255817e18ab8dd178c5b93bd935d18992744d8edba08453cfd2c2d3f33026cf78343f94ce3d6713cdedd9e6d4358257b41152ff2d406558ac64776b571666

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1023.exe

Filesize
468KB

MD5
aa42c9cf7680d30f4e10fa1b3db6bfe3

SHA1
af9c2a61033aad30756565fdaa84d8ee7e287f6d

SHA256
17ed46f86827edc9c5edd4a76bb23a42f2772e00f1244199160b8a3ad830fbb6

SHA512
7b92aa36ef903bd408fd597d10b939911e9f1bd46362f6d65c295e66907ecce47b91405dd9ddd6d2f663842337d11f9a31ff5376f5ebfd687c1ecae6c0b91a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe

Filesize
468KB

MD5
1a1e28533056af9f38e4463b8dabc1a3

SHA1
0065600277df4550035856e672da308d9c00d2e1

SHA256
201ff24c8b446b3f249d331150f282039b3e7ea040c2ae60646bc25c764c9e0f

SHA512
5953d08bce531cd4cbe13a70ea54dff3eed1c59d0c01c64438775562f92841680f0e1bce60e189aced3b0e9cffa1416d4e4d53cde0f8951fc4bfc2c8d0162c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe

Filesize
468KB

MD5
7751c1164cb4ef20d4048c21190e5ac2

SHA1
76bcab229157409b05c59b29b4da4ca469ed2018

SHA256
881a58714687e592ecd97fd2f08c098950d8d942a141a72092938f5342fa6aea

SHA512
878d2f4f855713a7a49ecd7b72ad7092af46bf5564ed86f22885bc6acac36914628ac599a4776d12a126904f5da905b13f3e218b5bb136e6502e594a1dd120bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1547.exe

Filesize
468KB

MD5
1eaead10f79eeee170445f827e2d7d7a

SHA1
ac67cdca8f81b300b2f3c624fab5fbdfdadbbd0d

SHA256
3ba0332aa7d2ec87e9bc60e376f672db3bfd940e6d651331495ff8c650c5bd1f

SHA512
89295e6fcfcd08a1fd1d5c92e12986585b61acc60bb2eb7442759bc714e0dfff8b07fc7628be4382a0f70849d7583b38943cdc15dc110d8e8a64d513e7417432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17529.exe

Filesize
468KB

MD5
d367433ae57bb035f29f7a688dff4528

SHA1
edc81955bd463c46477e890026c8dfebf6da0271

SHA256
54a4c276fc02f86e226858a7248f15ef7bb185864a073945b955fdbf1428f230

SHA512
8ed494e22d0ae4093483c977ea9a2e4b9fb9e5d3b013df9803ae32ce35782d39acef6cb1195db2a9b5f607739853c6a1e56e6a85f761bbcfd9bb576c0bc0cdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18786.exe

Filesize
468KB

MD5
5244ee1605441f4f173d4a992c4ff724

SHA1
2acb61723b2d2653463c9bc01b1a10081cc34d40

SHA256
ce760a0266879449ae3a5fd3ee91b01b9f46821e9a954957900243b3bbced8d1

SHA512
bff0846595c3dc9714a2770d8151a805b77541c66c57959f1af1b1a6e2c451671810b527b7b9c16d7b6065346b899d23039005367e28a85a64b174fbb0bb3071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe

Filesize
468KB

MD5
9abccbc3e68399d9312b2cb66d58ede6

SHA1
cd78b28bef05bad826dd03319ab5ea7d6a6dbe59

SHA256
e0188e405770b65453ec3e3780896214a64e6cbd68c4b1ff2e0c55d3088bdfb9

SHA512
9d0b152c77e8353c8e1eb28ab2ef01705d7f9701d6aec631b0293a096206976508720b5b9981e3fe4c1553e0fa2796e1144caf8faf5c8808daf0a89db924bb72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25034.exe

Filesize
468KB

MD5
371fc0782276b8b66652570551ab305b

SHA1
2d6c9db8c100bf7a31e2e022351fa6d4b8f6d85b

SHA256
946f0034f56cbec999363f189aa97fe17a705003d1202c71251f2ad6a4126fd1

SHA512
b25f689b390dd7108204be49d593479439f73811b710338a36d0f2c9aaf64724954d596d6d844370464d400d5291e4ea3736616172da0ce71e1ee61d1b4fd604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe

Filesize
468KB

MD5
84588ddc9debee5161e764220eff9e50

SHA1
8923722a2ccd65f99b79834d65c34e4985a7842a

SHA256
0655f10035c5b241b89b25373eea44ab2375cdbcee08d6bde496e03472df2cf9

SHA512
9c088631efddf95d4b9e3399c7e5c5d75ab5dc5e2f00d85849ee0c3300a15234ee2cf10a2a2601da1b4837e6c3eb89c39b6be5ac91bf883ef1fd01320ed5e767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26274.exe

Filesize
468KB

MD5
98ebd8559aa0f1c9d9db9e53c2e11263

SHA1
b00e9ae1b1dbfa87de8b9f30626d4897c63a8af8

SHA256
b9507bef718ee68b752a488a1f91d63090f9b8f78de56a2af2dc8e664b4dab2c

SHA512
5454e7d5336fa5080660490d28ae7b9463600ef6773ea1af10ee157bf422f82729bbfd0509d3a3ed038673569058ef7e76df3c773e8f670a106c882433939359

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe

Filesize
468KB

MD5
bde5f14e5f293ec95fad41cb585f02c2

SHA1
f4d71c5c00a45bd3cebe0881fb8a0565f93f3347

SHA256
7f5011d42a2f4d54394ce2889ed50760cc9fd77cec1cfa3a8299ff594849cae0

SHA512
8c09fb011328eeebd3da53dd8b2487265bfc43e59bc3e0fc892fc32eeec3623f7f371604f1900ad71b3fe19705dc04e111d436330c248fead86baac08052e0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32648.exe

Filesize
468KB

MD5
8303d02856b02f6fd1d3bcc2a05323c7

SHA1
d76fd840dce8cb4ac7d7d2e5c822c7bc90ad3ccf

SHA256
5106effba751a445a2030e69bd16e48625abc5c69b1856030c91d3504a18c001

SHA512
8dfdc2dbe73170696890738e625db97bbb9d64de914d5c6f408c4d672afdecd0272226e636df5eaab701063be690d37917d1a1391d9d7ea0d2f49865c888b41a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe

Filesize
468KB

MD5
bdc9ea8d22b135e4f483ab930fcb949b

SHA1
13f06b77482d661b0b7156522e1136953a9426a1

SHA256
7c17a117f700f150322d9c7add1f27cb71613d81ae7a29d30e389a564b22d524

SHA512
bb0d42f60b483a712d7f50360b3be160f02bfefbb65d7ad0ad78b7ac1ed03dd04f0f3ab17c9f3f462c43efa48007d78fc5caf274305f8047b70e252eed2fac23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe

Filesize
468KB

MD5
90a597f9391f4c7441d895d4f82543e3

SHA1
14044fd27a7bf768b28ab4e25ebd6a1d35a9af8a

SHA256
e4b5891b579c7ab0ce4f62b19e7d6a3687c9ec83a85cf3635fe09e1f7927ecb0

SHA512
c8d2a1ed46905e08c4b4e064edf3ec886bcdc117890d2ffc9d69ed19c11785b8241081bc68d6290bca13bb08f7753845705e55797dd8700e2b829e329d2dc6a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40224.exe

Filesize
468KB

MD5
b5a6f7e5d1646c2d8eaecccbb28d787a

SHA1
12c75fe58c7118507009fc00291688e254570e9f

SHA256
5f993420e24d7c862163f3bd95a9e870fde949598721b15e88ef3c5b45d3d384

SHA512
8f7b645b73aec27e174e9df33f55318b18445f5845eeec9ebb605cacfefaffcce61f63f22803a097893bc8a07034b81a4574d129651156a2fb209b016838f94b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40550.exe

Filesize
468KB

MD5
b010f0880e993f41d97185da90f4d8f5

SHA1
20204d31748314424c82d3e5748de400d4768c03

SHA256
e1be2a27c54c9ec405642da41b5f69efbeb9bfda20526adc80ec4bd3146ba300

SHA512
e30098204687120a6ff67d00f95d562c5d1d243298cf15666fa7bc36176e74b7230702cf74f90dec5c76940afbbc4838c64a1d23ea0167944fd40a7ff1824dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe

Filesize
468KB

MD5
26a73aae6b20ffada3eb6493691bbe9c

SHA1
5ab6de888a86a994d40694611c039a77dc448ed9

SHA256
d1dfd0104c46997b5bb170f16d9089f8c6fcc7671b75f4cbc4942969b188b0ce

SHA512
9ffe00c0189a763e9d53a7e241edcde78b3cbc2c16e318b0340a245a4be39ce3c375d971861d50a5f37f9774b8876f62f34e93f747e2b0edf18598ef2cdc21b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe

Filesize
468KB

MD5
df55326f1cbe69642084f0755bc57510

SHA1
f1722851db060189cd303cdcc1615880354b4107

SHA256
b92c0f865b204dd81eb04abafb50df9abffb4d74a502cdf9c7960cc783b73e30

SHA512
f7691b79455bdb42a7375bb20de01a3a5f9bf9b058aebb3640f4dc4edee325d499e8f5f5150b184cbe8e651e6c557f7ce371688dda7465ff1a2963a3915f43a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42684.exe

Filesize
468KB

MD5
ce43e7e9a860b964da5b7f0cd3d77db6

SHA1
4b40e75b46b32263c0cac7d8db30227e996111b9

SHA256
2efbcec3c4e5e364df1ed0e1e14c56aec76601ae3098e27be912877c8933acd5

SHA512
114c94041bfb502b510016b59b3e40167771c11812987bdc8d1c3ef21d64bc07dbb8f4f9fea6d64cb010df008f9d3a88830e15b0471676f71c6ca59d71a52105

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43888.exe

Filesize
468KB

MD5
41d6cb968b72feeef0013af09323a138

SHA1
1b0e202ca9a60744fdf8f4c52219acd12f9f4cdf

SHA256
e74c86c109c21d61b86089e07bf00a07b0d2ecd36b253eabc757f84f8e9c3e0b

SHA512
c2d67fd8ce2202c05b1ce56ec6e5851060f747ad6d74a0ece3705ce24cd675eb0f991fa19991eae989f2fd357b1f5b793c03317fe222e3ad4d1f8365a307615c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe

Filesize
468KB

MD5
b29734c6adab7c68b5e24459702c7b33

SHA1
90ad33e67ca0f37daf1dab510c4bbfc43f88d7ea

SHA256
b5179c9a0e6478fae5b04242388f5c2c3e1ed960af003701b121aadc7e1de197

SHA512
1534b7018ac1fae2902b6f236b241065345f0dcabf72f90c7a91f86d6294fc51a661832d6edba7dff2b8dbcac292abddd57fa618818de6285706233e8f5d34af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe

Filesize
468KB

MD5
a78c71ac1bae02c68905ec2acb1cac36

SHA1
a8f5426de0ccbc893849806007d43e862f9127d1

SHA256
570fbd7cceaf9cb15d1a48fe4a722133c9827cd2e3d455d47e15d7628deb7541

SHA512
46917e37f51067e91a3caca4fa96a6002791e5e13ebc88526e8ec5b9ac93ecb14337b2efcf980703087f1e14729ab656fee3b1f4fcec990f4353654e09c2d93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe

Filesize
468KB

MD5
0a3e52a072c67f51e64ac7ba08b390cc

SHA1
84bdc35c37910cc32057e0311814ae91e59e3faa

SHA256
01c5c721b940ce29cc5aa5ed422f7bc81a3c67dcbce92c106d32528ed83aa03e

SHA512
b9acc9d57e6e1ecc16ddd7b936011af3f47ae5f6c14bf8d04060f745d2073fedc6dad2505db28b7a3ba986715f185cecf3066ffcf444ca924826da2351b463a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe

Filesize
468KB

MD5
80a445767e892f8d55f084b7dc388cd2

SHA1
d723f9a2dfa7946dd14f560eb7a771a1f6727f01

SHA256
69399aaf7711d808038a17e01af1987988f04ede41ba4ce68c3b8fa4a72e99c7

SHA512
8621b39b515bf28272257d639e40833f662784fa79037b80ccf11cdc6f627c1af3d84145132cdaa40afc70ccf78ca1d01950595bc2aa34634ed78560983240c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe

Filesize
468KB

MD5
465def2223fe55ff2b9ce3a1544012e5

SHA1
95f703f77d813ec31694c18fa3ede77393253ab4

SHA256
3868baeb81c269291b3f3013eb6aa9aad25a03c7ccfcaa1e7a048220986523b5

SHA512
8d1d01d802f0cf507fb4c1341ab64850084239e0bd248e1932064a0f919fb2b5176dc2bda0610c3e3e13c14ebf6961d412e369ed38af1e92ef681d521a2c0ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe

Filesize
468KB

MD5
2cc23ab6ef67b3b2124d4867c0a60410

SHA1
1e0bf37cf7f5768dada364afce1f8cfa500b9a28

SHA256
a5cd7a89bc09149574effde8681e5203a034e60dc0f62d4f5147d67f5810178a

SHA512
247ca2892d000932a0b8de1bbef7a3119481cdf747f8e6285eeef5ac0bed25e5d9fe4c254c83c963dc48dc379ccdf928f1ffd73315e9e3a94b7ac0c711b2a993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58392.exe

Filesize
468KB

MD5
19126031361065e62ce1975e33c5f632

SHA1
aef23fcf591c737d1a2e85a1ba2ea0540130f20d

SHA256
6edf02cbc1661356c888193223f9d53c4015eb35298a0313580e2c47c3ef7916

SHA512
a933c4444f84e1a3f167d3edff4ab08c7d9a247e06a8c5f815bff2b05731004ce3fc9b4068e98fb6625d539e69c23cd5b926687bd899fab4a996eb61f9fa54f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60151.exe

Filesize
468KB

MD5
6d302d81a90a27cfda488ea8e724a811

SHA1
214f353ef6a3ae29cf6f33b80d7b72fbe31d17f1

SHA256
25159fcb985c1c2ead4d5cbc09000621585fd585b253bfbfe06e46e6eeb8c96a

SHA512
0725cb1e4369d0621f5b3038dcdc0a8afbce5744f4477edf07d1a8115d5554e3b5b9383ca00919232b2a682bda137dde65b8aac835db971aedc31b70f4fc832e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe

Filesize
468KB

MD5
bc1372a85fbea637e0cf40b6101d6ed5

SHA1
a0016388cd47d065576253be9213a7f9f6a4908f

SHA256
98d84a513da18a9b857a6ccbefe6241093ba48fbd7e590c67b0fe8a1c698d08f

SHA512
cc1795c746e077362bca3770f74631cdabab8106ec9a7a2c3c4c854c76814cc72a75f38c66f4d34aa6541767816bf22840b4a828047d69bab2417a1ef915c2ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe

Filesize
468KB

MD5
a9969d6d2add2b7e5acabc5baf2c412b

SHA1
a2a0fe41b480d0fd9c49f24bae2d864b73d6bb70

SHA256
efb945a8d749e3371dd06984f2b05d1df24cc958601b6684e122dabc190a2cd9

SHA512
590911a14e630fa6c6f80c5320ff4a7aba6f58992562cd297cba848444783118491166cd43d02039a7be4610cbfe2f3acf79d2cf80d4216258fbb21e8ff13032

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe

Filesize
468KB

MD5
150913a353d423361390b9e137db8ada

SHA1
d84a94ec41d0c97472b61d728ece93a0de63decc

SHA256
ff36eb38c62301d212b21e456099faa3ced619b3b0fdae41a3bf0973aa2ee32d

SHA512
f8ca2f4f5fbeb1dea30c7b1c4a7a43d6817c0f682c96bf88ad8908e86e0246052b60d66491d51df23e6f5e0c93a9097afeaef019cdb8581bca05d6624ada26ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64514.exe

Filesize
468KB

MD5
5611e1ccef063cf2703e286e3c5c4dc7

SHA1
414f3a508631bb7f0b7358f1fedf5ddd03312f10

SHA256
5c6fdd8480260d5a12573a8e365d9c729f55eec80e868dca5e36175cae559175

SHA512
6074e6779d0300b05188ba880ba7f948c6b20a6572eb569cca6db454e4c1f3f1245f0e066665326e710942aed0929ce500062837372c06b52dcdce146928e400

Download Submit
memory/1564-2639-0x00000000776C0000-0x00000000776D8000-memory.dmp

Filesize
96KB

Download
memory/1564-2638-0x0000000077480000-0x0000000077620000-memory.dmp

Filesize
1.6MB

Download
memory/1564-2640-0x0000000077730000-0x000000007778F000-memory.dmp

Filesize
380KB

Download
memory/4904-2642-0x0000000075030000-0x00000000750C4000-memory.dmp

Filesize
592KB

Download
memory/16148-2648-0x00007FFA2DF70000-0x00007FFA2E165000-memory.dmp

Filesize
2.0MB

Download